Null Pointer Dereference Vulnerability in Linux Kernel (CVE-2022-49805)
Summary
CVE-2022-49805: In the Linux kernel, the following vulnerability has been resolved: net: lan966x: Fix potential null-ptr-deref in lan966x_stats_init() lan966x_stats_init() calls create_singlethread_workqueue() and not checked the ret va... Affects linux versions < 6.0.10-1. Fixed in 6.0.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. However, like any complex software, it can have vulnerabilities. CVE-2022-49805 affects the lan966x driver, which is responsible for managing network interfaces in certain hardware configurations. This vulnerability arises from a failure to check the return value of a function that creates a work queue, potentially leading to a null pointer dereference.
Vulnerability Detail
CVE-2022-49805 is a vulnerability in the Linux kernel's lan966x driver, specifically in the lan966x_stats_init() function. This function calls create_singlethread_workqueue() without verifying its return value. If the function fails, it returns NULL, leading to a null pointer dereference when subsequent code attempts to access the work queue. This can cause system instability or crashes, impacting the overall reliability of the operating system.
How To Fix
Minimum fixed version
6.0.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-49805 is a critical vulnerability in the Linux kernel that can lead to system instability due to a null pointer dereference. It is essential to update to the patched version to mitigate risks. Regular monitoring with tools like Vulert can help ensure your applications remain secure against such vulnerabilities.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49805 is a vulnerability in the Linux kernel that can lead to a null pointer dereference in the lan966x driver.
If exploited, this vulnerability can cause system crashes or instability, affecting the performance of applications relying on the kernel.
If you are using the Linux kernel version prior to 6.0.10-1, your system may be vulnerable. You can check your system using the Vulert playground at Vulert Scanner.
The best protection is to update your Linux kernel to the fixed version 6.0.10-1 or later.
Vulert monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities, helping you maintain secure applications.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
