Critical NULL Dereference Vulnerability in Linux Kernel - CVE-2022-49944
Summary
CVE-2022-49944: In the Linux kernel, the following vulnerability has been resolved: Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()" The recent commit 87d0e2f41b8c ("usb: typec: ucsi: add a common function u... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware, system resources, and provides essential services for applications. It is widely used in various distributions, including Debian. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes, data loss, or unauthorized access. This specific vulnerability affects the USB Type-C UCSI (USB Type-C Connector System Software Interface) implementation within the kernel, which is responsible for managing USB connections and power delivery.
Vulnerability Detail
CVE-2022-49944 is a regression introduced by a recent commit that added a common function for unregistering connectors in the UCSI subsystem. This change inadvertently caused a NULL dereference when reading the power supply sysfs, leading to potential system instability. The issue arises from a stale sysfs entry that should have been removed but remains with NULL operations, resulting in unreleased power devices. If exploited, this vulnerability could lead to crashes or undefined behavior in the system.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-49944 is a significant vulnerability in the Linux kernel that can lead to system instability due to a NULL dereference in the UCSI subsystem. Users are urged to update their kernel to the patched version 6.0.2-1 or later to ensure system security and stability. Regular monitoring for vulnerabilities using tools like Vulert can help maintain a secure environment.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49944 is a vulnerability in the Linux kernel that causes a NULL dereference when reading the power supply sysfs due to a regression in the UCSI subsystem.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. By uploading your manifest file like package-lock.json, you can check if your application is affected by CVE-2022-49944.
Exploiting this vulnerability could lead to system crashes, data loss, or undefined behavior, compromising system stability and security.
Yes, a patch is available in version 6.0.2-1 of the Linux kernel. Users should update to this version or later to mitigate the vulnerability.
While there are no specific workarounds, it is crucial to monitor for updates and apply them as soon as possible to protect your system from potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
