CVE-2022-50452 (GCVE-0-2022-50452)
Vulnerability from cvelistv5
Published
2025-10-01 11:45
Modified
2025-10-01 11:45
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net: sched: cake: fix null pointer access issue when cake_init() fails When the default qdisc is cake, if the qdisc of dev_queue fails to be inited during mqprio_init(), cake_reset() is invoked to clear resources. In this case, the tins is NULL, and it will cause gpf issue. The process is as follows: qdisc_create_dflt() cake_init() q->tins = kvcalloc(...) --->failed, q->tins is NULL ... qdisc_put() ... cake_reset() ... cake_dequeue_one() b = &q->tins[...] --->q->tins is NULL The following is the Call Trace information: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:cake_dequeue_one+0xc9/0x3c0 Call Trace: <TASK> cake_reset+0xb1/0x140 qdisc_reset+0xed/0x6f0 qdisc_destroy+0x82/0x4c0 qdisc_put+0x9e/0xb0 qdisc_create_dflt+0x2c3/0x4a0 mqprio_init+0xa71/0x1760 qdisc_create+0x3eb/0x1000 tc_modify_qdisc+0x408/0x1720 rtnetlink_rcv_msg+0x38e/0xac0 netlink_rcv_skb+0x12d/0x3a0 netlink_unicast+0x4a2/0x740 netlink_sendmsg+0x826/0xcc0 sock_sendmsg+0xc5/0x100 ____sys_sendmsg+0x583/0x690 ___sys_sendmsg+0xe8/0x160 __sys_sendmsg+0xbf/0x160 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f89e5122d04 </TASK>
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/154f4c06d9dbec1a14e91286c70b6305810302e0
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1dc0a019550fd38ec6cab2d73c90df2bd659c96b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/51f9a8921ceacd7bf0d3f47fa867a64988ba1dcb
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/86aa1390898146f1de277bb6d2a8ed7fc7a43f12
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ae48bee2830bf216800e1447baca39541e27a12e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bc8301ea7e7f1bb9d2ba2fcdf7b5ec2f0792b47e
Impacted products
Vendor Product Version
Linux Linux Version: 046f6fd5daefac7f5abdafb436b30f63bc7c602b
Version: 046f6fd5daefac7f5abdafb436b30f63bc7c602b
Version: 046f6fd5daefac7f5abdafb436b30f63bc7c602b
Version: 046f6fd5daefac7f5abdafb436b30f63bc7c602b
Version: 046f6fd5daefac7f5abdafb436b30f63bc7c602b
Version: 046f6fd5daefac7f5abdafb436b30f63bc7c602b
 Create a notification for this product.
   Linux Linux Version: 4.19
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_cake.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "86aa1390898146f1de277bb6d2a8ed7fc7a43f12",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "bc8301ea7e7f1bb9d2ba2fcdf7b5ec2f0792b47e",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "ae48bee2830bf216800e1447baca39541e27a12e",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "154f4c06d9dbec1a14e91286c70b6305810302e0",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "1dc0a019550fd38ec6cab2d73c90df2bd659c96b",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "51f9a8921ceacd7bf0d3f47fa867a64988ba1dcb",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_cake.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.264",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.264",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.221",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.152",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.76",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.6",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: cake: fix null pointer access issue when cake_init() fails\n\nWhen the default qdisc is cake, if the qdisc of dev_queue fails to be\ninited during mqprio_init(), cake_reset() is invoked to clear\nresources. In this case, the tins is NULL, and it will cause gpf issue.\n\nThe process is as follows:\nqdisc_create_dflt()\n\tcake_init()\n\t\tq-\u003etins = kvcalloc(...)        ---\u003efailed, q-\u003etins is NULL\n\t...\n\tqdisc_put()\n\t\t...\n\t\tcake_reset()\n\t\t\t...\n\t\t\tcake_dequeue_one()\n\t\t\t\tb = \u0026q-\u003etins[...]   ---\u003eq-\u003etins is NULL\n\nThe following is the Call Trace information:\ngeneral protection fault, probably for non-canonical address\n0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nRIP: 0010:cake_dequeue_one+0xc9/0x3c0\nCall Trace:\n\u003cTASK\u003e\ncake_reset+0xb1/0x140\nqdisc_reset+0xed/0x6f0\nqdisc_destroy+0x82/0x4c0\nqdisc_put+0x9e/0xb0\nqdisc_create_dflt+0x2c3/0x4a0\nmqprio_init+0xa71/0x1760\nqdisc_create+0x3eb/0x1000\ntc_modify_qdisc+0x408/0x1720\nrtnetlink_rcv_msg+0x38e/0xac0\nnetlink_rcv_skb+0x12d/0x3a0\nnetlink_unicast+0x4a2/0x740\nnetlink_sendmsg+0x826/0xcc0\nsock_sendmsg+0xc5/0x100\n____sys_sendmsg+0x583/0x690\n___sys_sendmsg+0xe8/0x160\n__sys_sendmsg+0xbf/0x160\ndo_syscall_64+0x35/0x80\nentry_SYSCALL_64_after_hwframe+0x46/0xb0\nRIP: 0033:0x7f89e5122d04\n\u003c/TASK\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-01T11:45:25.394Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/86aa1390898146f1de277bb6d2a8ed7fc7a43f12"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc8301ea7e7f1bb9d2ba2fcdf7b5ec2f0792b47e"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae48bee2830bf216800e1447baca39541e27a12e"
        },
        {
          "url": "https://git.kernel.org/stable/c/154f4c06d9dbec1a14e91286c70b6305810302e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/1dc0a019550fd38ec6cab2d73c90df2bd659c96b"
        },
        {
          "url": "https://git.kernel.org/stable/c/51f9a8921ceacd7bf0d3f47fa867a64988ba1dcb"
        }
      ],
      "title": "net: sched: cake: fix null pointer access issue when cake_init() fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50452",
    "datePublished": "2025-10-01T11:45:25.394Z",
    "dateReserved": "2025-09-17T14:53:07.011Z",
    "dateUpdated": "2025-10-01T11:45:25.394Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50452\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-01T12:15:38.210\",\"lastModified\":\"2025-10-02T19:12:17.160\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: sched: cake: fix null pointer access issue when cake_init() fails\\n\\nWhen the default qdisc is cake, if the qdisc of dev_queue fails to be\\ninited during mqprio_init(), cake_reset() is invoked to clear\\nresources. In this case, the tins is NULL, and it will cause gpf issue.\\n\\nThe process is as follows:\\nqdisc_create_dflt()\\n\\tcake_init()\\n\\t\\tq-\u003etins = kvcalloc(...)        ---\u003efailed, q-\u003etins is NULL\\n\\t...\\n\\tqdisc_put()\\n\\t\\t...\\n\\t\\tcake_reset()\\n\\t\\t\\t...\\n\\t\\t\\tcake_dequeue_one()\\n\\t\\t\\t\\tb = \u0026q-\u003etins[...]   ---\u003eq-\u003etins is NULL\\n\\nThe following is the Call Trace information:\\ngeneral protection fault, probably for non-canonical address\\n0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN\\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\\nRIP: 0010:cake_dequeue_one+0xc9/0x3c0\\nCall Trace:\\n\u003cTASK\u003e\\ncake_reset+0xb1/0x140\\nqdisc_reset+0xed/0x6f0\\nqdisc_destroy+0x82/0x4c0\\nqdisc_put+0x9e/0xb0\\nqdisc_create_dflt+0x2c3/0x4a0\\nmqprio_init+0xa71/0x1760\\nqdisc_create+0x3eb/0x1000\\ntc_modify_qdisc+0x408/0x1720\\nrtnetlink_rcv_msg+0x38e/0xac0\\nnetlink_rcv_skb+0x12d/0x3a0\\nnetlink_unicast+0x4a2/0x740\\nnetlink_sendmsg+0x826/0xcc0\\nsock_sendmsg+0xc5/0x100\\n____sys_sendmsg+0x583/0x690\\n___sys_sendmsg+0xe8/0x160\\n__sys_sendmsg+0xbf/0x160\\ndo_syscall_64+0x35/0x80\\nentry_SYSCALL_64_after_hwframe+0x46/0xb0\\nRIP: 0033:0x7f89e5122d04\\n\u003c/TASK\u003e\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/154f4c06d9dbec1a14e91286c70b6305810302e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1dc0a019550fd38ec6cab2d73c90df2bd659c96b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/51f9a8921ceacd7bf0d3f47fa867a64988ba1dcb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/86aa1390898146f1de277bb6d2a8ed7fc7a43f12\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ae48bee2830bf216800e1447baca39541e27a12e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bc8301ea7e7f1bb9d2ba2fcdf7b5ec2f0792b47e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.