Null Pointer Dereference Vulnerability in Linux Kernel's USB PHY Driver
Summary
CVE-2022-49756: In the Linux kernel, the following vulnerability has been resolved: phy: usb: sunplus: Fix potential null-ptr-deref in sp_usb_phy_probe() sp_usb_phy_probe() will call platform_get_resource_byname() that may fail and retu... Affects linux versions < 6.1.11-1. Fixed in 6.1.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of devices and functionalities, including USB interfaces. The specific vulnerability affects the USB PHY driver, which is responsible for managing USB physical layer devices. This driver is crucial for ensuring proper communication between USB hardware and the operating system, making its stability and security vital for system integrity.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the sp_usb_phy_probe() function within the USB PHY driver. This issue arises when platform_get_resource_byname() fails and returns a NULL value. Subsequently, the devm_ioremap() function attempts to use usbphy->moon4_res_mem->start as input, leading to a potential null pointer dereference. If exploited, this vulnerability could cause system crashes or unpredictable behavior, compromising the stability of systems utilizing the affected driver.
How To Fix
Minimum fixed version
6.1.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate risks.
Conclusion
The CVE-2022-49756 vulnerability in the Linux kernel's USB PHY driver poses a significant risk due to potential null pointer dereference issues. It is essential to update to the patched version to ensure system stability and security. Regular monitoring of vulnerabilities using tools like Vulert can help maintain the integrity of your software.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49756 is a vulnerability in the Linux kernel's USB PHY driver that can lead to a null pointer dereference.
Exploitation of this vulnerability may cause system crashes or unpredictable behavior, affecting the stability of systems using the affected USB PHY driver.
Yes, a patch is available in version 6.1.11-1 of the Linux package for Debian 12 and 13.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground without any signup.
While there are no specific workarounds, it is crucial to prioritize updating your package to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
