Kernel NULL Pointer Dereference Vulnerability in Linux Package
Summary
CVE-2022-49483: In the Linux kernel, the following vulnerability has been resolved: drm/msm/disp/dpu1: avoid clearing hw interrupts if hw_intr is null during drm uninit If edp modeset init is failed due to panel being not ready and prob... Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services for software applications. It is widely used in various distributions, including Debian. This vulnerability affects the Linux kernel versions prior to 5.18.5-1, specifically in the drm/msm/disp/dpu1 module, which handles display management for certain hardware. The vulnerability arises during the uninitialization process when hardware interrupts are cleared without proper checks, leading to potential system crashes.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49483, originates from a failure to check if the hardware interrupt pointer (hw_intr) is null during the uninitialization of the DRM (Direct Rendering Manager) subsystem. If the initialization of the eDP (Embedded DisplayPort) modeset fails due to the panel being unready, the system attempts to clear hardware interrupts and dereference a null pointer, resulting in a kernel NULL pointer dereference. This can lead to system instability, crashes, or unexpected behavior, posing a significant risk to systems utilizing affected kernel versions.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the kernel to the fixed version.
Conclusion
CVE-2022-49483 is a critical vulnerability in the Linux kernel that can lead to severe system instability due to a NULL pointer dereference. Users are strongly advised to update their kernel to version 5.18.5-1 or later to mitigate the risks associated with this vulnerability. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49483 is a vulnerability in the Linux kernel that can lead to a kernel NULL pointer dereference, causing system crashes.
The vulnerability affects Linux kernel versions prior to 5.18.5-1.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
Exploiting this vulnerability can lead to system instability, crashes, and unexpected behavior, which can affect the overall functionality of the system.
The recommended action is to update to the patched version as there are no specific workarounds available for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
