Kernel Crash Vulnerability in Linux Packages: CVE-2022-49165
Summary
CVE-2022-49165: In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Prevent decoding NV12M jpegs into single-planar buffers If the application queues an NV12M jpeg as output buffer, but then queues a sin... Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including process management, memory management, and device drivers. The kernel is crucial for system stability and performance. This specific vulnerability affects the imx-jpeg media driver, which is responsible for handling JPEG image decoding, particularly in NV12M format. The vulnerability arises when an application queues incompatible buffer types, leading to potential system crashes.
Vulnerability Detail
CVE-2022-49165 is a vulnerability in the Linux kernel that occurs when an application queues an NV12M JPEG as an output buffer but subsequently queues a single planar capture buffer. This mismatch causes the kernel to attempt to dereference a NULL pointer in the mxc_jpeg_addrs function, resulting in a kernel crash. The vulnerability can lead to system instability and may affect any application relying on the imx-jpeg driver for image processing, posing risks to data integrity and availability.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid queuing NV12M JPEGs as output buffers when using single planar capture buffers. This can help prevent the kernel crash until the package is updated.
Conclusion
CVE-2022-49165 is a significant vulnerability in the Linux kernel that can lead to system crashes due to improper handling of image buffers in the imx-jpeg driver. Users are advised to update their Linux packages to the latest version to mitigate this risk. Temporary workarounds can be employed until the update is applied.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49165 is a vulnerability in the Linux kernel that can cause a kernel crash when incompatible buffer types are queued in the imx-jpeg media driver.
The vulnerability affects Linux packages in Debian 11, 12, and 13, particularly those versions prior to 5.17.3-1.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring installation.
The risks include potential system crashes, data loss, and instability in applications relying on the imx-jpeg driver for image processing.
Yes, updating the Linux package to version 5.17.3-1 or later will permanently fix the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
