Null Pointer Dereference in Linux Kernel's xHCI Driver - CVE-2022-49962
Summary
CVE-2022-49962: In the Linux kernel, the following vulnerability has been resolved: xhci: Fix null pointer dereference in remove if xHC has only one roothub The remove path in xhci platform driver tries to remove and put both main and s... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. The xHCI (eXtensible Host Controller Interface) driver is responsible for managing USB 3.0 devices, ensuring efficient communication between the operating system and connected peripherals. This vulnerability arises from improper handling of root hub references, which can lead to system instability during reboot.
Vulnerability Detail
CVE-2022-49962 is a vulnerability in the Linux kernel's xHCI platform driver that results in a null pointer dereference when attempting to remove a host controller that has only one root hub. The issue occurs during the removal process, where the driver incorrectly attempts to remove both the main and shared host controller drivers, leading to a crash during system reboot. This vulnerability can cause significant disruptions, particularly in environments relying on USB devices for critical operations.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2022-49962 is a critical vulnerability in the Linux kernel's xHCI driver that can lead to system crashes during reboot. It is essential to update to the patched version 6.0.2-1 to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your software.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49962 is a vulnerability in the Linux kernel's xHCI driver that can lead to a null pointer dereference during system reboot.
This vulnerability can cause system crashes when rebooting if USB devices are connected, potentially leading to data loss or system instability.
If you are using a version of the Linux kernel prior to 6.0.2-1, your system may be vulnerable. You can check your kernel version using the command 'uname -r'.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
