Kernel NULL Pointer Dereference Vulnerability in Linux Package: CVE-2022-50063
Summary
CVE-2022-50063: In the Linux kernel, the following vulnerability has been resolved: net: dsa: felix: suppress non-changes to the tagging protocol The way in which dsa_tree_change_tag_proto() works is that when dsa_tree_notify() fails, i... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It supports a wide range of functionalities, including process management, memory management, and device control. This vulnerability specifically affects the DSA (Distributed Switch Architecture) subsystem, which is responsible for managing multiple Ethernet switches in a network. The issue arises from improper handling of tagging protocol changes, leading to potential system crashes.
Vulnerability Detail
CVE-2022-50063 is a vulnerability in the Linux kernel that occurs in the DSA subsystem when changing the tagging protocol. The function dsa_tree_change_tag_proto() fails to handle errors correctly, leading to a scenario where the system may attempt to act on an outdated protocol operation. This can result in a kernel NULL pointer dereference, causing a crash. The vulnerability can be triggered by forcing an error during the tagging protocol change, which can leave the system in an unstable state and render network ports inoperational.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, avoiding changes to the tagging protocol in a multi-switch environment until the patch is applied may help mitigate the risk of encountering this issue.
Conclusion
CVE-2022-50063 is a critical vulnerability in the Linux kernel that can lead to system crashes due to improper error handling in the DSA subsystem. Users are advised to update their Linux packages to the patched version to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50063 is a vulnerability in the Linux kernel that can lead to a kernel crash due to improper handling of tagging protocol changes in the DSA subsystem.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to a kernel crash, resulting in system instability and inoperable network ports.
Yes, a patch is available in version 6.0.2-1 of the Linux package for Debian 12 and 13.
While there are no specific workarounds, it is advisable to avoid changing the tagging protocol in a multi-switch environment until the patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
