Null Pointer Dereference Vulnerability in Linux Kernel (CVE-2022-49806)
Summary
CVE-2022-49806: In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: Fix potential null-ptr-deref in sparx_stats_init() and sparx5_start() sparx_stats_init() calls create_singlethread_workqueue() a... Affects linux versions < 6.0.10-1. Fixed in 6.0.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system processes. It is widely used in various distributions, including Debian. This vulnerability affects the Linux kernel's microchip sparx5 driver, which is responsible for managing network functionalities. The vulnerability arises from improper error handling in the initialization process, potentially leading to system instability.
Vulnerability Detail
In the Linux kernel, specifically within the microchip sparx5 driver, a null pointer dereference vulnerability exists due to the failure to check the return value of the create_singlethread_workqueue() function. If this function fails, it returns NULL, leading to a dereference of a null pointer when queue_delayed_work() is called. This can result in a system crash or undefined behavior, as the code attempts to access properties of a non-existent work queue.
How To Fix
Minimum fixed version
6.0.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-49806 is a critical vulnerability in the Linux kernel that can lead to significant system issues if not addressed. Users are strongly advised to update their systems to the patched version to ensure security and stability. Monitoring tools like Vulert can assist in identifying such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49806 is a vulnerability in the Linux kernel that can lead to a null pointer dereference, potentially causing system crashes.
If exploited, this vulnerability can lead to system instability or crashes, affecting the overall performance and reliability of the operating system.
If you are using an affected version of the Linux kernel (prior to 6.0.10-1), your system may be vulnerable. You can check your system's kernel version using the command 'uname -r'.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just a manifest file like package-lock.json. Visit https://vulert.com for more information.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
