CVE-2022-49740

一、漏洞信息
 漏洞编号：[CVE-2022-49740](https://nvd.nist.gov/vuln/detail/CVE-2022-49740)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.x分值：
  BaseScore：7.1 High
  Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds readsThis patch fixes slab-out-of-bounds reads in brcmfmac that occur inbrcmf_construct_chaninfo() and brcmf_enable_bw40_2g() when the countvalue of channel specifications provided by the device is greater thanthe length of  list->element[] , decided by the size of the  list allocated with kzalloc(). The patch adds checks that make the functionsfree the buffer and return -EINVAL if that is the case. Note that thenegative return is handled by the caller, brcmf_setup_wiphybands() orbrcmf_cfg80211_attach().Found by a modified version of syzkaller.Crash Report from brcmf_construct_chaninfo():==================================================================BUG: KASAN: slab-out-of-bounds in brcmf_setup_wiphybands+0x1238/0x1430Read of size 4 at addr ffff888115f24600 by task kworker/0:2/1896CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G        W  O      5.14.0+ #132Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014Workqueue: usb_hub_wq hub_eventCall Trace: dump_stack_lvl+0x57/0x7d print_address_description.constprop.0.cold+0x93/0x334 kasan_report.cold+0x83/0xdf brcmf_setup_wiphybands+0x1238/0x1430 brcmf_cfg80211_attach+0x2118/0x3fd0 brcmf_attach+0x389/0xd40 brcmf_usb_probe+0x12de/0x1690 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_set_configuration+0x984/0x1770 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_new_device.cold+0x463/0xf66 hub_event+0x10d5/0x3330 process_one_work+0x873/0x13e0 worker_thread+0x8b/0xd10 kthread+0x379/0x450 ret_from_fork+0x1f/0x30Allocated by task 1896: kasan_save_stack+0x1b/0x40 __kasan_kmalloc+0x7c/0x90 kmem_cache_alloc_trace+0x19e/0x330 brcmf_setup_wiphybands+0x290/0x1430 brcmf_cfg80211_attach+0x2118/0x3fd0 brcmf_attach+0x389/0xd40 brcmf_usb_probe+0x12de/0x1690 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_set_configuration+0x984/0x1770 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_new_device.cold+0x463/0xf66 hub_event+0x10d5/0x3330 process_one_work+0x873/0x13e0 worker_thread+0x8b/0xd10 kthread+0x379/0x450 ret_from_fork+0x1f/0x30The buggy address belongs to the object at ffff888115f24000 which belongs to the cache kmalloc-2k of size 2048The buggy address is located 1536 bytes inside of 2048-byte region [ffff888115f24000, ffff888115f24800)Memory state around the buggy address: ffff888115f24500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888115f24580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00>ffff888115f24600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc                   ^ ffff888115f24680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888115f24700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc==================================================================Crash Report from brcmf_enable_bw40_2g():==========---truncated---
 漏洞公开时间：2025-03-28 01:15:38
 漏洞创建时间：2025-03-28 02:11:39
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-49740
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4920ab131b2dbae7464b72bdcac465d070254209 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9cf5e99c1ae1a85286a76c9a970202750538394c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b2e412879595821ff1b5545cbed5f108fba7f5b6 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e4991910f15013db72f6ec0db7038ea67a57052e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f06de1bb6d61f0c18b0213bbc6298960037f9d42 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-49740 | https://bugzilla.suse.com/show_bug.cgi?id=1240233 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-49740.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1240233 |
| suse_bugzilla | https://git.kernel.org/stable/c/9cf5e99c1ae1a85286a76c9a970202750538394c | https://bugzilla.suse.com/show_bug.cgi?id=1240233 |
| suse_bugzilla | https://git.kernel.org/stable/c/b2e412879595821ff1b5545cbed5f108fba7f5b6 | https://bugzilla.suse.com/show_bug.cgi?id=1240233 |
| suse_bugzilla | https://git.kernel.org/stable/c/e4991910f15013db72f6ec0db7038ea67a57052e | https://bugzilla.suse.com/show_bug.cgi?id=1240233 |
| suse_bugzilla | https://git.kernel.org/stable/c/f06de1bb6d61f0c18b0213bbc6298960037f9d42 | https://bugzilla.suse.com/show_bug.cgi?id=1240233 |
| suse_bugzilla | https://git.kernel.org/stable/c/4920ab131b2dbae7464b72bdcac465d070254209 | https://bugzilla.suse.com/show_bug.cgi?id=1240233 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-49740 | https://bugzilla.suse.com/show_bug.cgi?id=1240233 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2355532 | https://bugzilla.suse.com/show_bug.cgi?id=1240233 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025032757-CVE-2022-49740-7f6e@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2355532 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025032757-CVE-2022-49740-7f6e@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2355532 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2022-49740 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/4920ab131b2dbae7464b72bdcac465d070254209 |  | nvd |
|  |  | https://git.kernel.org/stable/c/9cf5e99c1ae1a85286a76c9a970202750538394c |  | nvd |
|  |  | https://git.kernel.org/stable/c/b2e412879595821ff1b5545cbed5f108fba7f5b6 |  | nvd |
|  |  | https://git.kernel.org/stable/c/e4991910f15013db72f6ec0db7038ea67a57052e |  | nvd |
|  |  | https://git.kernel.org/stable/c/f06de1bb6d61f0c18b0213bbc6298960037f9d42 |  | nvd |
| linux_kernel | 5.4.232 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9cf5e99c1ae1a85286a76c9a970202750538394c |  | linuxkernelcves |
| linux_kernel | 5.10.168 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b2e412879595821ff1b5545cbed5f108fba7f5b6 |  | linuxkernelcves |
| linux_kernel | 5.15.93 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e4991910f15013db72f6ec0db7038ea67a57052e |  | linuxkernelcves |
| linux_kernel | 6.1.11 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f06de1bb6d61f0c18b0213bbc6298960037f9d42 |  | linuxkernelcves |
| linux_kernel | 6.2 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4920ab131b2dbae7464b72bdcac465d070254209 |  | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds readsThis patch fixes slab-out-of-bounds reads in brcmfmac that occur inbrcmf_construct_chaninfo() and brcmf_enable_bw40_2g() when the countvalue of channel specifications provided by the device is greater thanthe length of &#39;list-&gt;element[]&#39;, decided by the size of the &#39;list&#39;allocated with kzalloc(). The patch adds checks that make the functionsfree the buffer and return -EINVAL if that is the case. Note that thenegative return is handled by the caller, brcmf_setup_wiphybands() orbrcmf_cfg80211_attach().Found by a modified version of syzkaller.Crash Report from brcmf_construct_chaninfo():==================================================================BUG: KASAN: slab-out-of-bounds in brcmf_setup_wiphybands+0x1238/0x1430Read of size 4 at addr ffff888115f24600 by task kworker/0:2/1896CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G        W  O      5.14.0+ #132Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014Workqueue: usb_hub_wq hub_eventCall Trace: dump_stack_lvl+0x57/0x7d print_address_description.constprop.0.cold+0x93/0x334 kasan_report.cold+0x83/0xdf brcmf_setup_wiphybands+0x1238/0x1430 brcmf_cfg80211_attach+0x2118/0x3fd0 brcmf_attach+0x389/0xd40 brcmf_usb_probe+0x12de/0x1690 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_set_configuration+0x984/0x1770 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_new_device.cold+0x463/0xf66 hub_event+0x10d5/0x3330 process_one_work+0x873/0x13e0 worker_thread+0x8b/0xd10 kthread+0x379/0x450 ret_from_fork+0x1f/0x30Allocated by task 1896: kasan_save_stack+0x1b/0x40 __kasan_kmalloc+0x7c/0x90 kmem_cache_alloc_trace+0x19e/0x330 brcmf_setup_wiphybands+0x290/0x1430 brcmf_cfg80211_attach+0x2118/0x3fd0 brcmf_attach+0x389/0xd40 brcmf_usb_probe+0x12de/0x1690 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_set_configuration+0x984/0x1770 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_new_device.cold+0x463/0xf66 hub_event+0x10d5/0x3330 process_one_work+0x873/0x13e0 worker_thread+0x8b/0xd10 kthread+0x379/0x450 ret_from_fork+0x1f/0x30The buggy address belongs to the object at ffff888115f24000 which belongs to the cache kmalloc-2k of size 2048The buggy address is located 1536 bytes inside of 2048-byte region [ffff888115f24000, ffff888115f24800)Memory state around the buggy address: ffff888115f24500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888115f24580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<spanclass= q >&gt;ffff888115f24600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc</span>                   ^ ffff888115f24680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888115f24700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc==================================================================Crash Report from brcmf_enable_bw40_2g():==================================================================BUG: KASAN: slab-out-of-bounds in brcmf_cfg80211_attach+0x3d11/0x3fd0Read of size 4 at addr ffff888103787600 by task kworker/0:2/1896CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G        W  O      5.14.0+ #132Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014Workqueue: usb_hub_wq hub_eventCall Trace: dump_stack_lvl+0x57/0x7d print_address_description.constprop.0.cold+0x93/0x334 kasan_report.cold+0x83/0xdf brcmf_cfg80211_attach+0x3d11/0x3fd0 brcmf_attach+0x389/0xd40 brcmf_usb_probe+0x12de/0x1690 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_set_configuration+0x984/0x1770 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_new_device.cold+0x463/0xf66 hub_event+0x10d5/0x3330 process_one_work+0x873/0x13e0 worker_thread+0x8b/0xd10 kthread+0x379/0x450 ret_from_fork+0x1f/0x30Allocated by task 1896: kasan_save_stack+0x1b/0x40 __kasan_kmalloc+0x7c/0x90 kmem_cache_alloc_trace+0x19e/0x330 brcmf_cfg80211_attach+0x3302/0x3fd0 brcmf_attach+0x389/0xd40 brcmf_usb_probe+0x12de/0x1690 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_set_configuration+0x984/0x1770 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_new_device.cold+0x463/0xf66 hub_event+0x10d5/0x3330 process_one_work+0x873/0x13e0 worker_thread+0x8b/0xd10 kthread+0x379/0x450 ret_from_fork+0x1f/0x30The buggy address belongs to the object at ffff888103787000 which belongs to the cache kmalloc-2k of size 2048The buggy address is located 1536 bytes inside of 2048-byte region [ffff888103787000, ffff888103787800)Memory state around the buggy address: ffff888103787500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888103787580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<spanclass= q >&gt;ffff888103787600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc</span>                   ^ ffff888103787680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888103787700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc==================================================================The Linux kernel CVE team has assigned CVE-2022-49740 to this issue.
 openEuler评分：
  7.1
 Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4:受影响
2.master(6.12.33):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.openEuler-24.03-LTS:不受影响
6.openEuler-24.03-LTS-Next:不受影响
7.openEuler-24.03-LTS-SP1:不受影响
8.openEuler-24.03-LTS-SP2:不受影响
9.openEuler-24.03-LTS-SP3:不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-24.03-LTS-SP1:否
8.openEuler-24.03-LTS-SP2:否
9.openEuler-24.03-LTS-SP3:否

原因说明：
  1.openEuler-20.03-LTS-SP4:正常修复
2.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS:不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1:不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-SP2:不受影响-漏洞代码不能被攻击者触发
9.openEuler-24.03-LTS-SP3:不受影响-漏洞代码不能被攻击者触发

src-openEuler/kernel
Closed

Content Risk Flag

Comments (10)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2022-49740

Comments (10)

Search

src-openEuler/kernel
Closed