Critical NULL Dereference Vulnerability in Linux Kernel - Debian Packages
Summary
CVE-2022-49848: In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp-combo: fix NULL-deref on runtime resume Commit fc64623637da ("phy: qcom-qmp-combo,usb: add support for separate PCS_USB region") started t... Affects linux versions < 6.0.10-1. Fixed in 6.0.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The kernel is highly modular and supports a wide range of hardware architectures. This vulnerability specifically affects the qcom-qmp-combo PHY driver, which is used for USB connectivity on certain Qualcomm platforms. The issue arises when the driver attempts to access PCS_USB registers without a valid offset, leading to potential system crashes or instability.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49848, originates from a commit that incorrectly handles the base address for PCS_USB registers during runtime resume operations. If the offset for these registers is not provided, the driver may attempt to dereference a NULL pointer, resulting in a system crash or undefined behavior. This issue primarily affects platforms like SC7180 that do not supply a PCS_USB offset, making them susceptible to this flaw. The ramifications include potential denial of service and instability in systems utilizing the affected driver.
How To Fix
Minimum fixed version
6.0.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patch as soon as it becomes available to mitigate risks associated with this issue.
Conclusion
CVE-2022-49848 is a critical vulnerability in the Linux kernel affecting Debian packages, specifically related to the qcom-qmp-combo PHY driver. Users are strongly encouraged to update their kernel to the patched version 6.0.10-1 to mitigate risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49848 is a vulnerability in the Linux kernel that can lead to a NULL pointer dereference during runtime resume operations in the qcom-qmp-combo PHY driver.
If your system uses the affected driver without the necessary PCS_USB offset, it may crash or become unstable, leading to potential denial of service.
If you are using Debian 12 or 13 with the Linux kernel version prior to 6.0.10-1, your system may be vulnerable to this issue.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to protect your system from potential crashes and instability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
