Critical Null Pointer Dereference in Linux Kernel - Impacting Debian Linux Packages
Summary
CVE-2022-49960: In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix null pointer dereference Asus chromebook CX550 crashes during boot on v5.17-rc1 kernel. Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, managing hardware resources and providing essential services for applications. It is widely used in various distributions, including Debian. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes or unauthorized access. This specific vulnerability affects the Intel graphics driver within the kernel, particularly in Asus Chromebook CX550 devices, causing crashes during boot.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49960, arises from a null pointer dereference in the function tgl_get_bw_info() within the Intel graphics driver. This issue can lead to a kernel panic, resulting in the system becoming unresponsive and unable to boot. The root cause is a dereference of a null pointer, which can occur when the driver attempts to access hardware resources that are not properly initialized. This vulnerability poses significant risks, especially for users relying on affected devices for critical tasks.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the kernel as described above.
Conclusion
CVE-2022-49960 is a critical vulnerability in the Linux kernel that can lead to system crashes due to a null pointer dereference in the Intel graphics driver. Users are strongly advised to update their kernel to the patched version 6.0.2-1 to ensure system stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software without requiring extensive setup.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49960 is a vulnerability in the Linux kernel that causes a null pointer dereference in the Intel graphics driver, leading to system crashes.
The vulnerability primarily affects Debian Linux systems, particularly those running the 5.17-rc1 kernel version on Asus Chromebook CX550 devices.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
While there are no specific workarounds, it is advisable to limit the use of affected devices until the kernel can be updated to mitigate risks.
Detailed information about CVE-2022-49960 can be found on security databases and the official Linux kernel mailing lists. Additionally, Vulert provides real-time alerts for vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
