CVE-2022-48794

net: ieee802154: at86rf230: Stop leaking skb's

Description

In the Linux kernel, the following vulnerability has been resolved: net: ieee802154: at86rf230: Stop leaking skb's Upon error the ieee802154_xmit_complete() helper is not called. Only ieee802154_wake_queue() is called manually. In the Tx case we then leak the skb structure. Free the skb structure upon error before returning when appropriate. As the 'is_tx = 0' cannot be moved in the complete handler because of a possible race between the delay in switching to STATE_RX_AACK_ON and a new interrupt, we introduce an intermediate 'was_tx' boolean just for this purpose. There is no Fixes tag applying here, many changes have been made on this area and the issue kind of always existed.

N/A

CVSS

Severity:

EPSS 0.11%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/d2a1eaf51b7d4412319adb6acef114ba472d1692
https://git.kernel.org/stable/c/af649e5c95f56df64363bc46f6746b87819f9c0d
https://git.kernel.org/stable/c/6312f6a53fd3ea38125dcaca5e3c9aa7d8a60cf7
https://git.kernel.org/stable/c/455ef08d6e5473526fa6763f75a93f7198206966
https://git.kernel.org/stable/c/0fd484644c68897c490a3307bfcc8bf767df5a43
https://git.kernel.org/stable/c/23b2a25382400168427ea278f3d8bf4ecfd333bf
https://git.kernel.org/stable/c/1c72f04d52b7200bb83426a9bed378668271ea4a
https://git.kernel.org/stable/c/e5ce576d45bf72fd0e3dc37eff897bfcc488f6a9

Frequently Asked Questions

What is the severity of CVE-2022-48794?: CVE-2022-48794 has not yet been assigned a CVSS score.
How to fix CVE-2022-48794?: To fix CVE-2022-48794, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-48794 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2022-48794 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-48794?: CVE-2022-48794 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.