{"id":"DEBIAN-CVE-2022-49605","details":"In the Linux kernel, the following vulnerability has been resolved:  igc: Reinstate IGC_REMOVED logic and implement it properly  The initially merged version of the igc driver code (via commit 146740f9abc4, \"igc: Add support for PF\") contained the following IGC_REMOVED checks in the igc_rd32/wr32() MMIO accessors:  \tu32 igc_rd32(struct igc_hw *hw, u32 reg) \t{ \t\tu8 __iomem *hw_addr = READ_ONCE(hw-\u003ehw_addr); \t\tu32 value = 0;  \t\tif (IGC_REMOVED(hw_addr)) \t\t\treturn ~value;  \t\tvalue = readl(&hw_addr[reg]);  \t\t/* reads should not return all F's */ \t\tif (!(~value) && (!reg || !(~readl(hw_addr)))) \t\t\thw-\u003ehw_addr = NULL;  \t\treturn value; \t}  And:  \t#define wr32(reg, val) \\ \tdo { \\ \t\tu8 __iomem *hw_addr = READ_ONCE((hw)-\u003ehw_addr); \\ \t\tif (!IGC_REMOVED(hw_addr)) \\ \t\t\twritel((val), &hw_addr[(reg)]); \\ \t} while (0)  E.g. igb has similar checks in its MMIO accessors, and has a similar macro E1000_REMOVED, which is implemented as follows:  \t#define E1000_REMOVED(h) unlikely(!(h))  These checks serve to detect and take note of an 0xffffffff MMIO read return from the device, which can be caused by a PCIe link flap or some other kind of PCI bus error, and to avoid performing MMIO reads and writes from that point onwards.  However, the IGC_REMOVED macro was not originally implemented:  \t#ifndef IGC_REMOVED \t#define IGC_REMOVED(a) (0) \t#endif /* IGC_REMOVED */  This led to the IGC_REMOVED logic to be removed entirely in a subsequent commit (commit 3c215fb18e70, \"igc: remove IGC_REMOVED function\"), with the rationale that such checks matter only for virtualization and that igc does not support virtualization -- but a PCIe device can become detached even without virtualization being in use, and without proper checks, a PCIe bus error affecting an igc adapter will lead to various NULL pointer dereferences, as the first access after the error will set hw-\u003ehw_addr to NULL, and subsequent accesses will blindly dereference this now-NULL pointer.  This patch reinstates the IGC_REMOVED checks in igc_rd32/wr32(), and implements IGC_REMOVED the way it is done for igb, by checking for the unlikely() case of hw_addr being NULL.  This change prevents the oopses seen when a PCIe link flap occurs on an igc adapter.","modified":"2026-09-01T16:05:32.981599764Z","published":"2025-02-26T07:01:36Z","upstream":["CVE-2022-49605"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-49605"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.16-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49605.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.16-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49605.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.16-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49605.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}