CVE-2022-48794

In the Linux kernel, the following vulnerability has been resolved:

net: ieee802154: at86rf230: Stop leaking skbs

Upon error the ieee802154_xmit_complete() helper is not called. Only ieee802154_wake_queue() is called manually. In the Tx case we then leak the skb structure.

Free the skb structure upon error before returning when appropriate.

As the is_tx = 0 cannot be moved in the complete handler because of a possible race between the delay in switching to STATE_RX_AACK_ON and a new interrupt, we introduce an intermediate was_tx boolean just for this purpose.

There is no Fixes tag applying here, many changes have been made on this area and the issue kind of always existed.

Weakness

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected Software

Potential Mitigations

• Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
• For example, glibc in Linux provides protection against free of invalid pointers.
• When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
• To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.

References

• https://git.kernel.org/stable/c/0fd484644c68897c490a3307bfcc8bf767df5a43
• https://git.kernel.org/stable/c/1c72f04d52b7200bb83426a9bed378668271ea4a
• https://git.kernel.org/stable/c/23b2a25382400168427ea278f3d8bf4ecfd333bf
• https://git.kernel.org/stable/c/455ef08d6e5473526fa6763f75a93f7198206966
• https://git.kernel.org/stable/c/6312f6a53fd3ea38125dcaca5e3c9aa7d8a60cf7
• https://git.kernel.org/stable/c/af649e5c95f56df64363bc46f6746b87819f9c0d
• https://git.kernel.org/stable/c/d2a1eaf51b7d4412319adb6acef114ba472d1692
• https://git.kernel.org/stable/c/e5ce576d45bf72fd0e3dc37eff897bfcc488f6a9
• https://git.kernel.org/stable/c/0fd484644c68897c490a3307bfcc8bf767df5a43
• https://git.kernel.org/stable/c/1c72f04d52b7200bb83426a9bed378668271ea4a
• https://git.kernel.org/stable/c/23b2a25382400168427ea278f3d8bf4ecfd333bf
• https://git.kernel.org/stable/c/455ef08d6e5473526fa6763f75a93f7198206966
• https://git.kernel.org/stable/c/6312f6a53fd3ea38125dcaca5e3c9aa7d8a60cf7
• https://git.kernel.org/stable/c/af649e5c95f56df64363bc46f6746b87819f9c0d
• https://git.kernel.org/stable/c/d2a1eaf51b7d4412319adb6acef114ba472d1692
• https://git.kernel.org/stable/c/e5ce576d45bf72fd0e3dc37eff897bfcc488f6a9