Critical Null Pointer Dereference Vulnerability in Linux Kernel (CVE-2022-50135)
Summary
CVE-2022-50135: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup The function rxe_create_qp calls rxe_qp_from_init. Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is widely used in various environments, from servers to embedded systems. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes, data loss, or unauthorized access. This specific vulnerability affects the RDMA/rxe subsystem, which is responsible for remote direct memory access, allowing efficient data transfer between computers.
Vulnerability Detail
CVE-2022-50135 is a critical vulnerability in the Linux kernel's RDMA/rxe subsystem. It arises from improper handling of pointers in the rxe_create_qp function, where error conditions can lead to both scq and rcq being set to NULL. When the cleanup function rxe_qp_do_cleanup is subsequently called, it attempts to access these NULL pointers, resulting in a null pointer dereference error. This vulnerability can lead to system instability and potential crashes, making it a significant concern for users relying on the affected kernel versions.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-50135 presents a significant risk to systems running affected versions of the Linux kernel. Users are strongly advised to update to the patched version 6.0.2-1 or later to ensure system stability and security. Regular monitoring for vulnerabilities using tools like Vulert can help maintain a secure software environment.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50135 is a vulnerability in the Linux kernel that can lead to a null pointer dereference, potentially causing system crashes.
The vulnerability affects all versions prior to 6.0.2-1 in Debian 12 and 13.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
While there are no specific workarounds, it is crucial to prioritize updating your kernel to mitigate the risk associated with this vulnerability.
Exploiting this vulnerability could lead to system instability, crashes, and potential unauthorized access to sensitive data.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
