Kernel NULL Pointer Dereference Vulnerability in Linux Packages
Summary
CVE-2022-49930: In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix NULL pointer problem in free_mr_init() Lock grab occurs in a concurrent scenario, resulting in stepping on a NULL pointer. Affects linux versions < 6.0.8-1. Fixed in 6.0.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system, including process management, memory management, and device control. This vulnerability affects the Linux packages in Debian 12 and 13, specifically in the RDMA/hns subsystem, which is used for high-performance networking. The issue arises from improper initialization of mutex locks, leading to potential system crashes.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49930, originates from a NULL pointer dereference in the RDMA/hns subsystem of the Linux kernel. In a concurrent scenario, the lock is improperly handled, resulting in a crash when the system attempts to access a NULL pointer. This can lead to a denial of service, where the affected system becomes unresponsive. The vulnerability is triggered during the deregistration of memory regions, specifically in the free_mr_send_cmd_to_hw function. The call trace indicates the sequence of function calls leading to the crash, highlighting the critical nature of this issue.
How To Fix
Minimum fixed version
6.0.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2022-49930 is a critical vulnerability in the Linux kernel that can lead to system crashes due to a NULL pointer dereference. Users are advised to update their Linux packages to the patched version 6.0.8-1 to mitigate this risk. Regular monitoring and updating of software are essential to maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49930 is a vulnerability in the Linux kernel that can lead to a NULL pointer dereference, causing system crashes.
The vulnerability affects Linux packages in Debian 12 and 13 prior to version 6.0.8-1.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Exploiting this vulnerability can lead to a denial of service, making the system unresponsive and potentially causing data loss.
Yes, a patch is available in version 6.0.8-1 of the Linux package. Users should update their systems to this version.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
