CVE-2022-48908

What it actually does

Null pointer dereference in com20020pci_probe() when the 'ci' card info pointer from com20020pci_id_table is empty for certain PCI devices, causing KASAN-detected access at offset 0x28 during PCI driver initialization.

Why it matters to the business

Kernel panic or crash during boot or device enumeration on systems with affected ARCNET PCI hardware, resulting in denial of service and potential operational downtime for legacy industrial or embedded deployments using the com20020 driver.

How an attack unfolds

An attacker with physical or local access supplies or triggers enumeration of a PCI device matching an ID table entry lacking a 'ci' pointer; the probe path dereferences the null without a check, triggering the fault during pci_device_probe and really_probe.

How to fix it

Apply the upstream fix by updating the Linux kernel to the commit 8e3bc7c5bbf87e86e9cd652ca2a9166942d86206 or later stable releases that include the null check before using 'ci' in com20020pci_probe.

How to confirm the fix worked

Confirm the patch is present by inspecting the com20020pci_probe function for an explicit null check on 'ci' prior to dereference, or verify the running kernel contains commit 8e3bc7c5bbf87e86e9cd652ca2a9166942d86206.

Typical attack path

1. Attacker ensures vulnerable kernel boots with com20020_pci module loaded
2. PCI bus enumerates a device present in com20020pci_id_table with null ci entry
3. local_pci_probe calls com20020pci_probe which dereferences null ci
4. Kernel fault handler terminates the process or panics the system

How to detect it

Search kernel logs and dmesg for KASAN null-ptr-deref reports referencing com20020pci_probe, the RIP address shown in the advisory, or call traces containing local_pci_probe and pci_device_probe around the com20020 driver.

• KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
• RIP: 0010:com20020pci_probe+0x18d/0x13e0 [com20020_pci]
• com20020pci_probe
• pci_device_probe+0x34c/0x6d0

What your security team should do

• Identify systems using the com20020_pci driver and schedule kernel updates to the fixed commit
• Disable the com20020_pci module if ARCNET hardware is not required
• Monitor kernel boot logs for null-ptr-deref signatures until patched