Critical Null Pointer Dereference in Linux Kernel - CVE-2022-49928
Summary
CVE-2022-49928: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix null-ptr-deref when xps sysfs alloc failed There is a null-ptr-deref when xps sysfs alloc failed: BUG: KASAN: null-ptr-deref in sysfs_do_cre... Affects linux versions < 6.0.8-1. Fixed in 6.0.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. This vulnerability affects the kernel's handling of the xps sysfs allocation, which can lead to system instability and crashes if not addressed.
Vulnerability Detail
CVE-2022-49928 is a null pointer dereference vulnerability that occurs when the xps sysfs allocation fails. This issue can lead to a crash in the gssproxy process, as it attempts to dereference a null pointer. The vulnerability arises during the creation of sysfs links, specifically when the xprt_switch allocation fails. If exploited, this could result in denial of service, affecting system availability and reliability.
How To Fix
Minimum fixed version
6.0.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
CVE-2022-49928 is a critical vulnerability in the Linux kernel that can lead to system crashes due to null pointer dereference. It is essential to update to the patched version to ensure system stability and security. Regular monitoring of vulnerabilities using tools like Vulert can help maintain the integrity of your software.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49928 is a vulnerability in the Linux kernel that leads to a null pointer dereference, potentially causing system crashes.
If exploited, this vulnerability can lead to denial of service, making your system unstable and unreliable.
Yes, a patch is available in the form of an updated Linux package version 6.0.8-1.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize applying the patch as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
