Critical NULL Pointer Dereference in Linux Kernel - Debian Packages
Summary
CVE-2022-49184: In the Linux kernel, the following vulnerability has been resolved: net: sparx5: switchdev: fix possible NULL pointer dereference As the possible failure of the allocation, devm_kzalloc() may return NULL pointer. Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing system resources and facilitating communication between hardware and software. It is a highly versatile and widely used open-source platform that supports a variety of applications and services. The vulnerability identified as CVE-2022-49184 affects the switchdev functionality within the kernel, specifically in the sparx5 driver, which is responsible for managing network switches. This vulnerability can lead to system instability and potential crashes if not addressed promptly.
Vulnerability Detail
CVE-2022-49184 is a vulnerability in the Linux kernel where a possible NULL pointer dereference may occur due to the failure of the devm_kzalloc() memory allocation function. If the allocation fails, it returns a NULL pointer, which, if dereferenced, can lead to a system crash or unexpected behavior. This vulnerability is particularly concerning for systems relying on the sparx5 switchdev functionality, as it could disrupt network operations and compromise system integrity.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to monitor their systems for any unusual behavior and apply the patch as soon as it is available.
Conclusion
CVE-2022-49184 is a significant vulnerability in the Linux kernel that can lead to serious system issues if not addressed. Users of Debian 12 and 13 are strongly encouraged to update their kernel packages to the fixed version to ensure system stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49184 is a vulnerability in the Linux kernel that can lead to a NULL pointer dereference, potentially causing system crashes.
If exploited, this vulnerability can lead to system instability and crashes, particularly affecting network operations managed by the sparx5 driver.
You should update your Linux kernel to version 5.17.3-1 or later to mitigate the vulnerability.
Currently, there are no specific workarounds available. It is recommended to apply the patch as soon as possible.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
