Critical NULL Dereference Vulnerability in Linux Kernel (CVE-2022-49125)
Summary
CVE-2022-49125: In the Linux kernel, the following vulnerability has been resolved: drm/sprd: fix potential NULL dereference 'drm' could be null in sprd_drm_shutdown, and drm_warn maybe dereference it, remove this warning log. Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It is widely used in various distributions, including Debian. This vulnerability affects the Direct Rendering Manager (DRM) subsystem, specifically in the Spreadtrum (sprd) driver, which is responsible for managing graphics rendering. The vulnerability could lead to system instability or crashes if exploited.
Vulnerability Detail
CVE-2022-49125 is a vulnerability in the Linux kernel's DRM subsystem where a potential NULL pointer dereference could occur in the sprd_drm_shutdown function. If the 'drm' object is null, it may lead to a dereference, causing a system crash or unexpected behavior. This issue arises from improper error handling when retrieving resources, which could allow an attacker to exploit the system's graphics handling capabilities.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it becomes available to prevent potential exploitation.
Conclusion
CVE-2022-49125 is a significant vulnerability in the Linux kernel's DRM subsystem that can lead to system crashes due to a NULL pointer dereference. It is crucial to update to the patched version 5.17.3-1 to mitigate this risk. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49125 is a vulnerability in the Linux kernel that could lead to a NULL pointer dereference in the DRM subsystem, potentially causing system crashes.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor vulnerabilities without requiring code access.
Exploitation of this vulnerability could lead to system instability, crashes, or unauthorized access to system resources.
Yes, a patch is available in version 5.17.3-1 for Debian 12 and 13. It is recommended to update your Linux package to this version.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json. It helps developers ensure their applications are secure.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
