Null Pointer Dereference in Linux Kernel's RTC Feature - CVE-2022-49273
Summary
CVE-2022-49273: In the Linux kernel, the following vulnerability has been resolved: rtc: pl031: fix rtc features null pointer dereference When there is no interrupt line, rtc alarm feature is disabled. Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for all other parts of the system. It manages hardware resources, system calls, and process scheduling. The RTC (Real-Time Clock) subsystem is responsible for maintaining the current time and managing alarms. This vulnerability affects the RTC feature in the Linux kernel, specifically in the pl031 driver, which can lead to system instability if not addressed.
Vulnerability Detail
CVE-2022-49273 is a vulnerability in the Linux kernel's RTC subsystem where a null pointer dereference occurs when the RTC alarm feature is disabled due to the absence of an interrupt line. The issue arises because the alarm feature bit is cleared before the RTC device is allocated, leading to a crash or unexpected behavior in the system. This vulnerability can potentially disrupt timekeeping functions and affect applications relying on accurate time.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-49273 is a critical vulnerability in the Linux kernel's RTC subsystem that can lead to system instability due to a null pointer dereference. It is essential to update to the patched version to mitigate risks associated with this vulnerability. Regular monitoring and timely updates are key to maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49273 is a vulnerability in the Linux kernel that can lead to a null pointer dereference in the RTC subsystem.
This vulnerability can cause system crashes or instability, particularly affecting applications that rely on the RTC features.
If you are using a version of the Linux kernel prior to 5.17.3-1, your system may be at risk. It is recommended to update to the latest version.
While there are no specific workarounds, it is crucial to monitor your system for any unusual behavior and plan to update as soon as possible.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
