Kernel NULL Pointer Dereference Vulnerability in Linux Package
Summary
CVE-2022-50002: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, fix logic over MLX5_LAG_FLAG_NDEVS_READY Only set MLX5_LAG_FLAG_NDEVS_READY if both netdevices are registered. Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used in various distributions, including Debian. This vulnerability affects the Linux kernel's networking subsystem, specifically the MLX5 driver, which is used for managing network devices. The issue arises from improper handling of device pointers, leading to potential system crashes.
Vulnerability Detail
The vulnerability, identified as CVE-2022-50002, originates from an asymmetry in setting and clearing the MLX5_LAG_FLAG_NDEVS_READY flag in the Linux kernel. This flag is incorrectly set when both network devices are registered, but it is not cleared appropriately when one of the devices is unloaded. This can lead to a scenario where a null pointer dereference occurs during the execution of the mlx5_do_bond() function, potentially causing a system crash and impacting the stability of the network subsystem.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux package.
Conclusion
The CVE-2022-50002 vulnerability in the Linux kernel poses a significant risk to system stability due to improper handling of device pointers. It is essential to update to the patched version to ensure the integrity of the network subsystem and prevent potential crashes.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50002 is a vulnerability in the Linux kernel that can lead to a null pointer dereference, potentially causing system crashes.
If exploited, this vulnerability can lead to instability in the network subsystem, resulting in crashes and loss of connectivity.
The vulnerability affects Linux versions prior to 6.0.2-1 in Debian distributions.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
