Kernel NULL Pointer Dereference Vulnerability in Linux Package - CVE-2022-49070
Summary
CVE-2022-49070: In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix unregistering of framebuffers without device OF framebuffers do not have an underlying device in the Linux device hierarchy. Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of hardware architectures and is known for its stability and performance. The vulnerability CVE-2022-49070 affects the framebuffer device (fbdev) subsystem, which is responsible for managing graphical output on devices without a dedicated graphics card. This vulnerability can lead to system crashes and instability.
Vulnerability Detail
CVE-2022-49070 is a vulnerability in the Linux kernel's framebuffer device subsystem that allows for a NULL pointer dereference when unregistering framebuffers that do not have an underlying device. This issue was introduced by a commit that aimed to hot-unplug firmware framebuffer devices on forced removal. The lack of an underlying device for OF framebuffers means that the system attempts to access a non-existent device, resulting in a kernel crash. The error manifests as a kernel NULL pointer dereference, which can lead to severe system instability and crashes, particularly on ppc64le architecture.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the Linux package as described above.
Conclusion
CVE-2022-49070 is a critical vulnerability in the Linux kernel that can lead to system crashes due to a NULL pointer dereference. Users are strongly encouraged to update their Linux packages to the patched version 5.17.3-1 to mitigate the risk. Regular monitoring and timely updates are essential for maintaining system stability and security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49070 is a vulnerability in the Linux kernel that causes a NULL pointer dereference when unregistering certain framebuffers, leading to system crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against CVE-2022-49070 using the Vulert playground at Vulert Scanner.
The vulnerability can lead to kernel crashes and system instability, particularly affecting systems using the ppc64le architecture.
Yes, the vulnerability has been patched in version 5.17.3-1 of the Linux package for both Debian 12 and Debian 13.
While there are no specific workarounds, it is advisable to monitor your system for unusual behavior and apply the patch as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
