Kernel Panic: NULL Pointer Dereference in Linux Kernel's AR9331 PHY Driver
Summary
CVE-2022-49692: In the Linux kernel, the following vulnerability has been resolved: net: phy: at803x: fix NULL pointer dereference on AR9331 PHY Latest kernel will explode on the PHY interrupt config, since it depends now on allocated p... Affects linux versions < 5.18.14-1. Fixed in 5.18.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of hardware architectures and is known for its stability and performance. The AR9331 PHY driver, part of the kernel's networking stack, is responsible for managing physical layer connections in Ethernet devices. This vulnerability affects the driver by causing a NULL pointer dereference, leading to potential system crashes and instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the AR9331 PHY driver, specifically in the handling of PHY interrupt configuration. The issue arises when the kernel attempts to access an uninitialized pointer, resulting in a NULL pointer dereference. This can lead to a kernel panic, causing the system to become unresponsive. The vulnerability is triggered during the probe phase when the driver attempts to configure interrupts without having allocated the necessary private data structure. This flaw not only affects the AR9331 PHY but may also impact other PHYs such as QCA8081 and QCA9561.
How To Fix
Minimum fixed version
5.18.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the kernel as described in the 'how_to_fix' section.
Conclusion
The vulnerability CVE-2022-49692 in the Linux kernel's AR9331 PHY driver poses a significant risk by causing kernel panics due to NULL pointer dereferences. Users are strongly advised to update their kernels to the patched version to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining system stability and security.
See every vulnerability recorded for linux →
FAQ
A NULL pointer dereference occurs when a program attempts to access memory at a location that has not been initialized, leading to crashes or unpredictable behavior.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary consequence is a kernel panic, which can cause the system to crash and become unresponsive, potentially leading to data loss.
While the vulnerability is present in the Linux kernel, its impact may vary across different distributions depending on the kernel version in use.
If an immediate update is not possible, monitor your system closely for any signs of instability and consider isolating affected systems from critical networks until a patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
