Kernel Crash Vulnerability in Linux Package: CVE-2022-49476
Summary
CVE-2022-49476: In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix kernel crash at mt7921_pci_remove The crash log shown it is possible that mt7921_irq_handler is called while devm_free_irq is being ha... Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The mt76 driver, which supports various wireless devices, is integral for network connectivity. This vulnerability affects the mt7921 driver within the mt76 framework, leading to potential system crashes.
Vulnerability Detail
CVE-2022-49476 is a vulnerability in the Linux kernel's mt76 driver, specifically in the mt7921 component. The issue arises when the mt7921_irq_handler is invoked while the devm_free_irq function is being executed. This can lead to a kernel NULL pointer dereference, causing a crash. The crash log indicates that the system attempts to access a non-present page, resulting in a supervisor read access error in kernel mode. This vulnerability can lead to system instability and potential denial of service, affecting users relying on wireless connectivity.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-49476 is a significant vulnerability in the Linux kernel's mt76 driver that can lead to system crashes. Users are advised to update their systems to the patched version to mitigate the risk. Monitoring tools like Vulert can help in identifying such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49476 is a vulnerability in the Linux kernel's mt76 driver that can lead to kernel crashes due to improper handling of interrupts.
This vulnerability can cause system instability and crashes, particularly affecting users who rely on the mt7921 driver for wireless connectivity.
If you are using an affected version of the Linux kernel, it is crucial to update to the patched version 5.18.5-1 as soon as possible.
Yes, tools like Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by analyzing manifest files like package-lock.json.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
