Segmentation Fault in Linux Kernel's Ethernet Module: CVE-2022-49847
Summary
CVE-2022-49847: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: Fix segmentation fault at module unload Move am65_cpsw_nuss_phylink_cleanup() call to after am65_cpsw_nuss_cleanup_ndev()... Affects linux versions < 6.0.10-1. Fixed in 6.0.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of a Linux operating system, managing hardware resources and providing essential services for applications. The kernel supports various functionalities, including process management, memory management, and device control. The vulnerability CVE-2022-49847 affects the Ethernet module, specifically the TI AM65 CPSW driver, which is responsible for handling network communication in devices using this chipset. This vulnerability can lead to a segmentation fault during module unloading, potentially causing system instability.
Vulnerability Detail
CVE-2022-49847 is a vulnerability in the Linux kernel's Ethernet module, specifically in the TI AM65 CPSW driver. The issue arises when the function am65_cpsw_nuss_phylink_cleanup() is called before am65_cpsw_nuss_cleanup_ndev(), leading to a segmentation fault if the first slave link is active during module removal. This can result in a kernel panic, causing the system to become unresponsive and potentially leading to data loss or corruption. The vulnerability is characterized by a memory access violation, as indicated by the kernel's error logs.
How To Fix
Minimum fixed version
6.0.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to avoid unloading the affected module while the first slave link is active until the patch is applied.
Conclusion
CVE-2022-49847 is a significant vulnerability in the Linux kernel's Ethernet module that can lead to system instability. It is crucial to update to the patched version to mitigate the risks associated with this issue. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49847 is a vulnerability in the Linux kernel's Ethernet module that can cause a segmentation fault during module unloading.
This vulnerability can lead to a kernel panic, causing system instability and potential data loss if the affected module is unloaded while in use.
The vulnerability affects the Linux kernel versions prior to 6.0.10-1 on Debian 12 and 13.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update immediately, avoid unloading the affected module while the first slave link is active to prevent triggering the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
