Kernel Panic Vulnerability in Linux Package: drm/mediatek Callback Issue
Summary
CVE-2022-49506: In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add vblank register/unregister callback functions We encountered a kernel panic issue that callback data will be NULL when it's using in o... Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware resources and provides essential services for software applications. It is known for its stability, performance, and flexibility, making it a popular choice for various distributions, including Debian. The vulnerability in question affects the drm/mediatek subsystem, which is responsible for handling display-related functionalities in MediaTek chipsets. This vulnerability can lead to kernel panic, causing system instability and potential data loss.
Vulnerability Detail
The vulnerability arises from a timing issue between the mtk_disp_ovl_irq_handler() and mtk_ovl_disable_vblank() functions, where callback data can be NULL during the overlay interrupt handler. This can lead to a kernel panic, disrupting system operations. The issue is specifically related to the registration and unregistration of vblank callback functions, which must be handled correctly to prevent the callback data from being NULL when vblank is disabled.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk of kernel panic.
Conclusion
The CVE-2022-49506 vulnerability in the Linux kernel's drm/mediatek subsystem poses a significant risk of kernel panic due to NULL callback data. Users are encouraged to update to the patched version 5.18.5-1 to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining system stability.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49506 is a vulnerability in the Linux kernel related to the drm/mediatek subsystem, which can cause kernel panic due to NULL callback data.
This vulnerability can lead to system instability, causing unexpected crashes and potential data loss.
Yes, the patch is available in version 5.18.5-1 of the Linux package. Users should update to this version to resolve the issue.
If you cannot update, it is advisable to monitor your system closely for any signs of instability and consider alternative mitigation strategies until an update can be applied.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
