Critical NULL Pointer Dereference Vulnerability in Linux Kernel - CVE-2022-49195
Summary
CVE-2022-49195: In the Linux kernel, the following vulnerability has been resolved: net: dsa: fix panic on shutdown if multi-chip tree failed to probe DSA probing is atypical because a tree of devices must probe all at once, so out of N... Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It manages system resources, handles process scheduling, and facilitates communication between hardware and software components. The kernel is crucial for system stability and performance. This specific vulnerability affects the Linux kernel in Debian versions 12 and 13, where improper handling during the shutdown of multi-chip devices can lead to system crashes.
Vulnerability Detail
CVE-2022-49195 is a vulnerability in the Linux kernel related to the DSA (Distributed Switch Architecture) subsystem. The issue arises during the shutdown process of multi-chip trees when the initialization of the last switch fails. In such cases, the driver for the other switches may attempt to execute the shutdown method, leading to NULL pointer dereferences since the necessary data structures have not been created. This can result in system panics, causing instability and potential data loss.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the available patch by updating the kernel to the fixed version.
Conclusion
CVE-2022-49195 is a critical vulnerability in the Linux kernel that can lead to system crashes due to improper handling during the shutdown of multi-chip devices. Users are strongly advised to update their kernel to version 5.17.3-1 or later to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49195 is a vulnerability in the Linux kernel that can lead to NULL pointer dereferences during the shutdown of multi-chip devices, potentially causing system crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by CVE-2022-49195 without any signup.
The main consequence of this vulnerability is system instability, which can lead to crashes and data loss when the affected kernel attempts to shut down improperly initialized devices.
You can update your Linux kernel by running the command 'sudo apt-get update && sudo apt-get install linux' in your terminal, which will install the latest patched version.
Currently, there are no known workarounds for this vulnerability. The recommended action is to update to the patched version of the kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
