deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-48732
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: fix off by one in BIOS boundary checking

Bounds checking when parsing init scripts embedded in the BIOS reject
access to the last byte. This causes driver initialization to fail on
Apple eMac's with GeForce 2 MX GPUs, leaving the system with no working
console.

This is probably only seen on OpenFirmware machines like PowerPC Macs
because the BIOS image provided by OF is only the used parts of the ROM,
not a power-of-two blocks read from PCI directly so PCs always have
empty bytes at the end that are never accessed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-193
References: https://git.kernel.org/stable/c/1b777d4d9e383d2744fc9b3a09af6ec1893c8b1a; https://git.kernel.org/stable/c/909d3ec1bf9f0ec534bfc081b77c0836fea7b0e2; https://git.kernel.org/stable/c/acc887ba88333f5fec49631f12d8cc7ebd95781c
CVE: CVE-2022-48733
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix use-after-free after failure to create a snapshot

At ioctl.c:create_snapshot(), we allocate a pending snapshot structure and
then attach it to the transaction's list of pending snapshots. After that
we call btrfs_commit_transaction(), and if that returns an error we jump
to 'fail' label, where we kfree() the pending snapshot structure. This can
result in a later use-after-free of the pending snapshot:

1) We allocated the pending snapshot and added it to the transaction's
   list of pending snapshots;

2) We call btrfs_commit_transaction(), and it fails either at the first
   call to btrfs_run_delayed_refs() or btrfs_start_dirty_block_groups().
   In both cases, we don't abort the transaction and we release our
   transaction handle. We jump to the 'fail' label and free the pending
   snapshot structure. We return with the pending snapshot still in the
   transaction's list;

3) Another task commits the transaction. This time there's no error at
   all, and then during the transaction commit it accesses a pointer
   to the pending snapshot structure that the snapshot creation task
   has already freed, resulting in a user-after-free.

This issue could actually be detected by smatch, which produced the
following warning:

  fs/btrfs/ioctl.c:843 create_snapshot() warn: '&pending_snapshot->list' not removed from list

So fix this by not having the snapshot creation ioctl directly add the
pending snapshot to the transaction's list. Instead add the pending
snapshot to the transaction handle, and then at btrfs_commit_transaction()
we add the snapshot to the list only when we can guarantee that any error
returned after that point will result in a transaction abort, in which
case the ioctl code can safely free the pending snapshot and no one can
access it anymore.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/28b21c558a[PII_REDACTED]193b6f6602a94169093a; https://git.kernel.org/stable/c/7e4c72dbaf62f8978af8321a24dbd35566d3a78a; https://git.kernel.org/stable/c/9372fa1d73da5f1673921e365d0cd2c27ec7adc2
CVE: CVE-2022-48735
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: Fix UAF of leds class devs at unbinding

The LED class devices that are created by HD-audio codec drivers are
registered via devm_led_classdev_register() and associated with the
HD-audio codec device.  Unfortunately, it turned out that the devres
release doesn't work for this case; namely, since the codec resource
release happens before the devm call chain, it triggers a NULL
dereference or a UAF for a stale set_brightness_delay callback.

For fixing the bug, this patch changes the LED class device register
and unregister in a manual manner without devres, keeping the
instances in hda_gen_spec.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-476
References: https://git.kernel.org/stable/c/0e629052f013eeb61494d4df2f1f647c2a9aef47; https://git.kernel.org/stable/c/549f8ffc7b2f7561bea7f90930b6c5104318e87b; https://git.kernel.org/stable/c/813e9f3e06d22e29872d4fd51b54992d89cf66c8
CVE: CVE-2022-48736
Published: 2024-06-20
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-48737
Published: 2024-06-20
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-48738
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()

We don't currently validate that the values being set are within the range
we advertised to userspace as being valid, do so and reject any values
that are out of range.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/40f598698129b5ceaf31012f9501b775c7b6e57d; https://git.kernel.org/stable/c/586ef863c94354a7e00e5ae5ef01443d1dc99bc7; https://git.kernel.org/stable/c/65a61b1f56f[PII_REDACTED]930069fbdce94af08bf
CVE: CVE-2022-48739
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: hdmi-codec: Fix OOB memory accesses

Correct size of iec_status array by changing it to the size of status
array of the struct snd_aes_iec958. This fixes out-of-bounds slab
read accesses made by memcpy() of the hdmi-codec driver. This problem
is reported by KASAN.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/06feec6005c9d9500cd286ec440aabf8b2ddd94d; https://git.kernel.org/stable/c/10007bd96b6c4c3cfaea9e76c311b06a07a5e260; https://git.kernel.org/stable/c/1552e66be325a21d7eff49f46013fb402165a0ac
CVE: CVE-2022-48740
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

selinux: fix double free of cond_list on error paths

On error path from cond_read_list() and duplicate_policydb_cond_list()
the cond_list_destroy() gets called a second time in caller functions,
resulting in NULL pointer deref.  Fix this by resetting the
cond_list_len to 0 in cond_list_destroy(), making subsequent calls a
noop.

Also consistently reset the cond_list pointer to NULL after freeing.

[PM: fix line lengths in the description]
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/186edf7e368c40d06cf727a1ad14698ea67b74ad; https://git.kernel.org/stable/c/70caa32e6d81f45f0702070c0e4dfe945e92fbd7; https://git.kernel.org/stable/c/7ed9cbf7ac0d4ed86b356e1b944304ae9ee450d4
CVE: CVE-2022-48741
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

ovl: fix NULL pointer dereference in copy up warning

This patch is fixing a NULL pointer dereference to get a recently
introduced warning message working.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/4ee7e4a6c9b298da44029ed9ec8ed23ae49cc209; https://git.kernel.org/stable/c/9c7f8a35c5a83740c0e3ea540b6ad145c50d79aa; https://git.kernel.org/stable/c/e6b678c1a3673de6a5d2f4e22bb725a086a0701a
CVE: CVE-2022-48742
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()

While looking at one unrelated syzbot bug, I found the replay logic
in __rtnl_newlink() to potentially trigger use-after-free.

It is better to clear master_dev and m_ops inside the loop,
in case we have to replay it.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/2cf180360d66bd657e606c1217e0e668e6faa303; https://git.kernel.org/stable/c/36a9a0aee881940476b254e[PII_REDACTED]b23f210; https://git.kernel.org/stable/c/3bbe2019dd12b8d13671ee6cda055d49637b4c39
CVE: CVE-2022-48743
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

net: amd-xgbe: Fix skb data length underflow

There will be BUG_ON() triggered in include/linux/skbuff.h leading to
intermittent kernel panic, when the skb length underflow is detected.

Fix this by dropping the packet if such length underflows are seen
because of inconsistencies in the hardware descriptors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://git.kernel.org/stable/c/34aeb4da20f93ac80a6291a2dbe7b9c6460e9b26; https://git.kernel.org/stable/c/4d3fcfe8464838b3920bc2b939d888e0b792934e; https://git.kernel.org/stable/c/5aac9108a180fc06e28d4e7fb00247ce603b72ee
CVE: CVE-2022-48745
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Use del_timer_sync in fw reset flow of halting poll

Substitute del_timer() with del_timer_sync() in fw reset polling
deactivation flow, in order to prevent a race condition which occurs
when del_timer() is called and timer is deactivated while another
process is handling the timer interrupt. A situation that led to
the following call trace:
	RIP: 0010:run_timer_softirq+0x137/0x420
	<IRQ>
	recalibrate_cpu_khz+0x10/0x10
	ktime_get+0x3e/0xa0
	? sched_clock_cpu+0xb/0xc0
	__do_softirq+0xf5/0x2ea
	irq_exit_rcu+0xc1/0xf0
	sysvec_apic_timer_interrupt+0x9e/0xc0
	asm_sysvec_apic_timer_interrupt+0x12/0x20
	</IRQ>
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/2a038dd1d942f8fbc495c58fa592ff24af05f1c2; https://git.kernel.org/stable/c/3c5193a87b0fea090aa3f769d020337662d87b5e; https://git.kernel.org/stable/c/502c37b033fab7cde3e95a570af4f073306be45e
CVE: CVE-2022-48746
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix handling of wrong devices during bond netevent

Current implementation of bond netevent handler only check if
the handled netdev is VF representor and it missing a check if
the VF representor is on the same phys device of the bond handling
the netevent.

Fix by adding the missing check and optimizing the check if
the netdev is VF representor so it will not access uninitialized
private data and crashes.

BUG: kernel NULL pointer dereference, address:[PII_REDACTED]00036c
PGD 0 P4D 0
Oops: 0000 [#1] SMP NOPTI
Workqueue: eth3bond0 bond_mii_monitor [bonding]
RIP: 0010:mlx5e_is_uplink_rep+0xc/0x50 [mlx5_core]
RSP: 0018:ffff88812d69fd60 EFLAGS: 00010282
RAX: [PII_REDACTED] RBX: ffff8881cf800000 RCX: [PII_REDACTED]
RDX: ffff88812d69fe10 RSI:[PII_REDACTED]00001b RDI: ffff8881cf800880
RBP: ffff8881cf800000 R08: 00000445cabccf2b R09: [PII_REDACTED]
R10: [PII_REDACTED] R11: [PII_REDACTED] R12: ffff88812d69fe10
R13: 00000000fffffffe R14: ffff88820c0f9000 R15: [PII_REDACTED]
FS:  [PII_REDACTED](0000) GS:ffff88846fb00000(0000) knlGS:[PII_REDACTED]
CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
CR2:[PII_REDACTED]00036c CR3:[PII_REDACTED]d80006 CR4:[PII_REDACTED]370ea0
DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
Call Trace:
 mlx5e_eswitch_uplink_rep+0x31/0x40 [mlx5_core]
 mlx5e_rep_is_lag_netdev+0x94/0xc0 [mlx5_core]
 mlx5e_rep_esw_bond_netevent+0xeb/0x3d0 [mlx5_core]
 raw_notifier_call_chain+0x41/0x60
 call_netdevice_notifiers_info+0x34/0x80
 netdev_lower_state_changed+0x4e/0xa0
 bond_mii_monitor+0x56b/0x640 [bonding]
 process_one_work+0x1b9/0x390
 worker_thread+0x4d/0x3d0
 ? rescuer_thread+0x350/0x350
 kthread+0x124/0x150
 ? set_kthread_struct+0x40/0x40
 ret_from_fork+0x1f/0x30
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/4fad499d7fece448e7230d5e5b92f6d8a073e0bb; https://git.kernel.org/stable/c/a01ee1b8165f4161459b5ec4e728bc7130fe8cd4; https://git.kernel.org/stable/c/ec41332e02bd0acf1f24206867bb6a02f5877a62
CVE: CVE-2022-48747
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

block: Fix wrong offset in bio_truncate()

bio_truncate() clears the buffer outside of last block of bdev, however
current bio_truncate() is using the wrong offset of page. So it can
return the uninitialized data.

This happened when both of truncated/corrupted FS and userspace (via
bdev) are trying to read the last of bdev.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: https://git.kernel.org/stable/c/3ee859e384d453d6ac68bfd5971f630d9fa46ad3; https://git.kernel.org/stable/c/4633a79ff8bc82770486a063a08b55e5162521d8; https://git.kernel.org/stable/c/6cbf4c731d7812518cd857c2cfc3da9fd120f6ae
CVE: CVE-2022-48748
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

net: bridge: vlan: fix memory leak in __allowed_ingress

When using per-vlan state, if vlan snooping and stats are disabled,
untagged or priority-tagged ingress frame will go to check pvid state.
If the port state is forwarding and the pvid state is not
learning/forwarding, untagged or priority-tagged frame will be dropped
but skb memory is not freed.
Should free skb when __allowed_ingress returns false.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://git.kernel.org/stable/c/14be8d448fca6fe7b2a413831eedd55aef6c6511; https://git.kernel.org/stable/c/446ff1fc37c74093e81db40811a07b5a19f1d797; https://git.kernel.org/stable/c/c5e216e880fa6f2cd9d4a[PII_REDACTED]657163098
CVE: CVE-2022-48749
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pcc

The function performs a check on the "ctx" input parameter, however, it
is used before the check.

Initialize the "base" variable after the sanity check to avoid a
possible NULL pointer dereference.

Addresses-Coverity-ID: 1493866 ("Null pointer dereference")
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/170b22234d5495f5e0844246e23f004639ee89ba; https://git.kernel.org/stable/c/1ebc18836d5df09061657f8c548e594cbb519476; https://git.kernel.org/stable/c/8f069f6dde518dfebe86e848508c07e497bd9298
CVE: CVE-2022-48750
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

hwmon: (nct6775) Fix crash in clear_caseopen

Paweł Marciniak reports the following crash, observed when clearing
the chassis intrusion alarm.

BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 3 PID: 4815 Comm: bash Tainted: G S                5.16.2-200.fc35.x86_64 #1
Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./Z97 Extreme4, BIOS P2.60A 05/03/2018
RIP: 0010:clear_caseopen+0x5a/0x120 [nct6775]
Code: 68 70 e8 e9 32 b1 e3 85 c0 0f 85 d2 00 00 00 48 83 7c 24 ...
RSP: 0018:ffffabcb02803dd8 EFLAGS: 00010246
RAX: [PII_REDACTED] RBX: [PII_REDACTED] RCX: [PII_REDACTED]
RDX: ffff8e[PII_REDACTED] RSI: [PII_REDACTED] RDI: ffff8e87c7509a68
RBP: [PII_REDACTED] R08: [PII_REDACTED] R09:[PII_REDACTED]00000a
R10:[PII_REDACTED]00000a R11: f[PII_REDACTED]00000 R12:[PII_REDACTED]00001f
R13: ffff8e87c7509828 R14: ffff8e87c7509a68 R15: ffff8e88494527a0
FS:  00007f4db9151740(0000) GS:ffff8e8ebfec0000(0000) knlGS:[PII_REDACTED]
CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
CR2: [PII_REDACTED] CR3:[PII_REDACTED]b66001 CR4:[PII_REDACTED]1706e0
Call Trace:
 <TASK>
 kernfs_fop_write_iter+0x11c/0x1b0
 new_sync_write+0x10b/0x180
 vfs_write+0x209/0x2a0
 ksys_write+0x4f/0xc0
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x44/0xae

The problem is that the device passed to clear_caseopen() is the hwmon
device, not the platform device, and the platform data is not set in the
hwmon device. Store the pointer to sio_data in struct nct6775_data and
get if from there if needed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/79da533d3cc717ccc05ddbd3190da8a72bc2408b; https://git.kernel.org/stable/c/cfb7d12f2e4a4d694f49e9b4ebb352f7b67cdfbb; https://git.kernel.org/stable/c/79da533d3cc717ccc05ddbd3190da8a72bc2408b
CVE: CVE-2022-48751
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

net/smc: Transitional solution for clcsock race issue

We encountered a crash in smc_setsockopt() and it is caused by
accessing smc->clcsock after clcsock was released.

 BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: 0000 [#1] PREEMPT SMP PTI
 CPU: 1 PID: 50309 Comm: nginx Kdump: loaded Tainted: G E     5.16.0-rc4+ #53
 RIP: 0010:smc_setsockopt+0x59/0x280 [smc]
 Call Trace:
  <TASK>
  __sys_setsockopt+0xfc/0x190
  __x64_sys_setsockopt+0x20/0x30
  do_syscall_64+0x34/0x90
  entry_SYSCALL_64_after_hwframe+0x44/0xae
 RIP: 0033:0x7f16ba83918e
  </TASK>

This patch tries to fix it by holding clcsock_release_lock and
checking whether clcsock has already been released before access.

In case that a crash of the same reason happens in smc_getsockopt()
or smc_switch_to_fallback(), this patch also checkes smc->clcsock
in them too. And the caller of smc_switch_to_fallback() will identify
whether fallback succeeds according to the return value.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/38f0bdd548fd2ef5d481b88d8a2bfef968452e34; https://git.kernel.org/stable/c/4284225cd8001e134f5cf533a7cd244bbb654d0f; https://git.kernel.org/stable/c/c0bf3d8a943b6f2e912b7c1de03e2ef28e76f760
CVE: CVE-2022-48753
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

block: fix memory leak in disk_register_independent_access_ranges

kobject_init_and_add() takes reference even when it fails.
According to the doc of kobject_init_and_add()

   If this function returns an error, kobject_put() must be called to
   properly clean up the memory associated with the object.

Fix this issue by adding kobject_put().
Callback function blk_ia_ranges_sysfs_release() in kobject_put()
can handle the pointer "iars" properly.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/83114df32ae779df57e0af99a8ba6c3968b2ba3d; https://git.kernel.org/stable/c/fe4214a07e0b53d2af711f57519e33739c5df23f; https://git.kernel.org/stable/c/83114df32ae779df57e0af99a8ba6c3968b2ba3d
CVE: CVE-2022-48754
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

phylib: fix potential use-after-free

Commit bafbdd527d56 ("phylib: Add device reset GPIO support") added call
to phy_device_reset(phydev) after the put_device() call in phy_detach().

The comment before the put_device() call says that the phydev might go
away with put_device().

Fix potential use-after-free by calling phy_device_reset() before
put_device().
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/67d271760b037ce0806d687ee6057edc8afd4205; https://git.kernel.org/stable/c/aefaccd19379d6c4620269a162bfb88ff687f289; https://git.kernel.org/stable/c/bd024e36f68174b1793906c39ca16cee0c9295c2
CVE: CVE-2022-48755
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06

Johan reported the below crash with test_bpf on ppc64 e5500:

  test_bpf: #296 ALU_END_FROM_LE 64: 0x[PII_REDACTED]abcdef -> 0x67452301 jited:1
  Oops: Exception in kernel mode, sig: 4 [#1]
  BE PAGE_SIZE=4K SMP NR_CPUS=24 QEMU e500
  Modules linked in: test_bpf(+)
  CPU: 0 PID: 76 Comm: insmod Not tainted 5.14.0-03771-g98c2059e008a-dirty #1
  NIP: [PII_REDACTED]061c3c LR:[PII_REDACTED]6dea64 CTR:[PII_REDACTED]061c18
  REGS: c[PII_REDACTED]d3420 TRAP: 0700   Not tainted (5.14.0-03771-g98c2059e008a-dirty)
  MSR:  [PII_REDACTED] <EE,ME>  CR: 88002822  XER: 20000000 IRQMASK: 0
  <...>
  NIP [[PII_REDACTED]061c3c] 0x[PII_REDACTED]061c3c
  LR [[PII_REDACTED]6dea64] .__run_one+0x104/0x17c [test_bpf]
  Call Trace:
   .__run_one+0x60/0x17c [test_bpf] (unreliable)
   .test_bpf_init+0x6a8/0xdc8 [test_bpf]
   .do_one_initcall+0x6c/0x28c
   .do_init_module+0x68/0x28c
   .load_module+0x2460/0x2abc
   .__do_sys_init_module+0x120/0x18c
   .system_call_exception+0x110/0x1b8
   system_call_common+0xf0/0x210
  --- interrupt: c00 at 0x101d0acc
  <...>
  ---[ end trace 47b2bf19090bb3d0 ]---

  Illegal instruction

The illegal instruction turned out to be 'ldbrx' emitted for
BPF_FROM_[L|B]E, which was only introduced in ISA v2.06. Guard use of
the same and implement an alternative approach for older processors.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/129c71829d7f46423d95c19e8d87ce956d4c6e1c; https://git.kernel.org/stable/c/3bfbc00587dc883eaed383558ae512a351c2cd09; https://git.kernel.org/stable/c/3f5f766d5f7f95a69a630da3544a1a0cee1cdddf
CVE: CVE-2022-48756
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable

The function performs a check on the "phy" input parameter, however, it
is used before the check.

Initialize the "dev" variable after the sanity check to avoid a possible
NULL pointer dereference.

Addresses-Coverity-ID: 1493860 ("Null pointer dereference")
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/2b7e7df1eacd280e561ede3e[PII_REDACTED]71c951; https://git.kernel.org/stable/c/56480fb10b976581a363fd168dc2e4fbee87a1a7; https://git.kernel.org/stable/c/581317b1f001b[PII_REDACTED]d7019b75571daa100
CVE: CVE-2022-48757
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

net: fix information leakage in /proc/net/ptype

In one net namespace, after creating a packet socket without binding
it to a device, users in other net namespaces can observe the new
`packet_type` added by this packet socket by reading `/proc/net/ptype`
file. This is minor information leakage as packet socket is
namespace aware.

Add a net pointer in `packet_type` to keep the net namespace of
of corresponding packet socket. In `ptype_seq_show`, this net pointer
must be checked when it is not NULL.
CVSS Score: 7.1 (HIGH)
CWE: CWE-668
References: https://git.kernel.org/stable/c/47934e06b65637c88a762d9c98329ae6e3238888; https://git.kernel.org/stable/c/839ec7039513a4f84bfbaff953a[PII_REDACTED]bee; https://git.kernel.org/stable/c/8f88c78d24f6f346919007cd459fd7e51a8c7779