Critical NULL Pointer Dereference in Linux Kernel - vduse Control Device
Summary
CVE-2022-49329: In the Linux kernel, the following vulnerability has been resolved: vduse: Fix NULL pointer dereference on sysfs access The control device has no drvdata. Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to software applications. The vduse (virtio device user space) is a subsystem that allows user-space applications to interact with virtio devices. This subsystem is crucial for virtualization and containerization, enabling efficient communication between the host and guest systems. However, a vulnerability has been identified in the vduse control device, which can lead to a NULL pointer dereference, potentially causing system instability or crashes.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49329, arises from the absence of drvdata in the control device of the vduse subsystem. When accessing the msg_timeout attribute via sysfs, the system encounters a NULL pointer dereference, leading to a crash. This issue can be exploited by attackers with access to the control device, resulting in denial of service or system instability. The technical details indicate that the dereference occurs in the msg_timeout_show function, where the absence of necessary data leads to a critical failure in the kernel.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package to the fixed version.
Conclusion
The CVE-2022-49329 vulnerability in the Linux kernel's vduse subsystem poses a significant risk of system instability due to a NULL pointer dereference. It is essential to update to the patched version 5.18.5-1 to protect your system. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49329 is a vulnerability in the Linux kernel's vduse subsystem that leads to a NULL pointer dereference, potentially causing system crashes.
This vulnerability can lead to denial of service or system instability if exploited, particularly affecting systems that utilize the vduse control device.
Yes, the vulnerability has been fixed in the Linux package version 5.18.5-1. It is recommended to update to this version.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
While there are no specific workarounds, it is crucial to prioritize updating the package as soon as possible to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
