Critical NULL Pointer Dereference in Linux Kernel (CVE-2022-49703)
Summary
CVE-2022-49703: In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Store vhost pointer during subcrq allocation Currently the back pointer from a queue to the vhost adapter isn't set until after subcrq int... Affects linux versions < 5.18.14-1. Fixed in 5.18.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes or unauthorized access. This specific vulnerability affects the SCSI (Small Computer System Interface) subsystem, particularly in the ibmvfc driver, which is used for Fibre Channel communication on IBM Power systems.
Vulnerability Detail
CVE-2022-49703 is a critical vulnerability in the Linux kernel that arises from the improper handling of the back pointer from a queue to the vhost adapter during subcrq allocation. This issue can lead to a NULL pointer dereference when a pending subcrq interrupt from a previous kernel is replayed upon IRQ registration. The result is a crash that can occur during kexec or kdump operations, particularly on Power 9 systems using the legacy XICS interrupt controller. The vulnerability can potentially allow an attacker to exploit the kernel, leading to system instability or unauthorized access.
How To Fix
Minimum fixed version
5.18.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected SCSI subsystem or refrain from performing kexec/kdump operations until the kernel is updated. However, this is not a permanent solution and updating the kernel is strongly recommended.
Conclusion
CVE-2022-49703 is a significant vulnerability in the Linux kernel that can lead to system crashes and potential exploitation. It is crucial for users to update their systems to the patched version to ensure security and stability. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
This vulnerability primarily affects Linux kernel versions prior to 5.18.14-1, particularly on IBM Power systems using the ibmvfc driver.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Failing to address this vulnerability can lead to system crashes, data loss, and potential unauthorized access to sensitive information.
While waiting for a patch, it is advisable to avoid using the affected subsystem and refrain from performing kexec/kdump operations.
More information can be found in the official CVE database or through security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
