Critical NULL Dereference Vulnerability in Linux Kernel (CVE-2022-50133)
Summary
CVE-2022-50133: In the Linux kernel, the following vulnerability has been resolved: usb: xhci_plat_remove: avoid NULL dereference Since commit 4736ebd7fcaff1eb8481c140ba494962847d6e0a ("usb: host: xhci-plat: omit shared hcd if either ro... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of hardware architectures and is known for its stability and performance. However, vulnerabilities can arise, such as CVE-2022-50133, which affects the USB subsystem, specifically the xHCI platform driver. This vulnerability can lead to system crashes during reboot due to improper handling of NULL pointers.
Vulnerability Detail
CVE-2022-50133 is a vulnerability in the Linux kernel's USB subsystem, specifically in the xHCI platform driver. The issue originates from a code change that allows the 'shared_hcd' pointer to be NULL. When the system attempts to remove the USB host controller during a reboot, it can lead to a NULL pointer dereference, resulting in a kernel panic and system crash. This vulnerability can affect system stability and may lead to data loss if not addressed.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available.
Conclusion
CVE-2022-50133 is a critical vulnerability in the Linux kernel that can lead to system crashes due to NULL pointer dereference during USB host controller removal. It is essential to update to the patched version of the kernel to ensure system stability and security. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the integrity of your software.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50133 is a vulnerability in the Linux kernel that can cause a NULL pointer dereference during USB host controller removal, leading to system crashes.
This vulnerability can lead to kernel panics and system instability, especially during reboot processes, potentially resulting in data loss.
If you are using a version of the Linux kernel prior to 6.0.2-1, your system may be vulnerable. You can check your kernel version using the command 'uname -r'.
The best way to protect your system is to update to the patched version of the Linux kernel as soon as it is available.
Vulert is a tool that can monitor and alert for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
