Null Pointer Dereference Vulnerability in Linux Kernel - CVE-2022-49134
Summary
CVE-2022-49134: In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum: Guard against invalid local ports When processing events generated by the device's firmware, the driver protects itself from events rep... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for all other parts of the system. It manages hardware resources, facilitates communication between software and hardware, and ensures system stability. The kernel is crucial for system performance and security. This specific vulnerability affects the mlxsw driver, which is responsible for managing network switches. The issue arises when the driver processes events from the device's firmware, particularly concerning the CPU port, which can lead to system instability.
Vulnerability Detail
CVE-2022-49134 is a vulnerability in the Linux kernel's mlxsw driver, specifically related to the handling of events for local ports. The driver fails to adequately protect against events reported for the CPU port (local port 0), which, while existing, does not have all the necessary fields initialized. This oversight can lead to a NULL pointer dereference when the driver attempts to access uninitialized fields in the 'struct mlxsw_sp_port'. The vulnerability can result in system crashes or unexpected behavior, posing a significant risk to system integrity and availability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate risks.
Conclusion
CVE-2022-49134 represents a significant vulnerability in the Linux kernel's mlxsw driver, which can lead to system instability due to improper handling of CPU port events. It is crucial for users to update their systems to the patched version to mitigate risks associated with this vulnerability.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49134 is a vulnerability in the Linux kernel's mlxsw driver that can lead to a NULL pointer dereference due to improper handling of CPU port events.
This vulnerability can cause system crashes or unexpected behavior, potentially compromising system stability and availability.
If you are using a version of the Linux kernel prior to 5.17.3-1, your system may be vulnerable. You can check your system's kernel version using the command 'uname -r'.
You can use tools like Vulert, which monitors open-source vulnerabilities in your software by analyzing a manifest file such as package-lock.json.
Detailed information about CVE-2022-49134 can be found in the official CVE database and security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
