NULL Pointer Dereference in Linux Kernel's 8250_aspeed_vuart - CVE-2022-49392
Summary
CVE-2022-49392: In the Linux kernel, the following vulnerability has been resolved: serial: 8250_aspeed_vuart: Fix potential NULL dereference in aspeed_vuart_probe platform_get_resource() may fail and return NULL, so we should better ch... Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. The 8250_aspeed_vuart is a driver within the kernel that facilitates communication with serial devices. This driver is crucial for systems that rely on serial communication for various functionalities. The vulnerability in question arises from insufficient checks on the return value of platform_get_resource(), which can lead to system instability and crashes.
Vulnerability Detail
CVE-2022-49392 is a vulnerability in the Linux kernel's 8250_aspeed_vuart driver. The issue stems from the potential for a NULL pointer dereference when the platform_get_resource() function fails and returns NULL. If this dereference occurs, it can lead to a system crash or unexpected behavior, impacting the reliability of systems that depend on this driver for serial communication. This vulnerability highlights the importance of robust error handling in kernel drivers to prevent such critical failures.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, ensuring that your system is updated to the latest kernel version is a general best practice to mitigate potential risks.
Conclusion
CVE-2022-49392 is a significant vulnerability in the Linux kernel's 8250_aspeed_vuart driver that can lead to system instability due to a NULL pointer dereference. Users are encouraged to update to the patched version to ensure system reliability and security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49392 is a vulnerability in the Linux kernel that can lead to a NULL pointer dereference in the 8250_aspeed_vuart driver.
If exploited, this vulnerability can cause system crashes or unexpected behavior, particularly in systems relying on serial communication.
Yes, the vulnerability has been patched in version 5.18.5-1 of the Linux package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is advisable to monitor your system closely and apply the update as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
