Kernel Panic Vulnerability in Linux Package: CVE-2022-49400
Summary
CVE-2022-49400: In the Linux kernel, the following vulnerability has been resolved: md: Don't set mddev private to NULL in raid0 pers->free In normal stop process, it does like this: do_md_stop | md_stop (pers->free(); mddev->private=NU... Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of Linux operating systems, responsible for managing hardware resources and providing essential services for software applications. It supports a wide range of functionalities, including process management, memory management, and device control. This vulnerability specifically affects the RAID0 implementation within the kernel, which is used for data storage across multiple disks to improve performance and redundancy.
Vulnerability Detail
CVE-2022-49400 is a vulnerability in the Linux kernel that arises during the reshape process of RAID0 devices. The issue occurs when the kernel sets the mddev->private pointer to NULL after freeing memory associated with the RAID device. This can lead to a NULL pointer dereference when the new RAID attempts to use the mddev structure, resulting in a kernel panic. The vulnerability can cause system instability and crashes, particularly during RAID reshaping operations.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid reshaping RAID0 devices until the system is updated to the patched version. Additionally, removing the code that sets mddev->private to NULL in the raid0_free function can prevent the panic, but this is not a permanent solution and should be handled with caution.
Conclusion
CVE-2022-49400 is a significant vulnerability in the Linux kernel that can lead to critical system failures during RAID0 reshaping operations. It is essential for users to update their systems to the patched version to mitigate this risk. For those unable to update immediately, temporary workarounds can be employed, but caution is advised.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49400 is a vulnerability in the Linux kernel that can cause a kernel panic due to a NULL pointer dereference during RAID0 reshaping.
This vulnerability can lead to system crashes and instability, particularly when performing operations on RAID0 devices.
The vulnerability affects Linux versions prior to 5.18.5-1. Users should upgrade to this version or later.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If an immediate update is not possible, avoid reshaping RAID0 devices and consider implementing the temporary workaround by modifying the code cautiously.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
