Kernel Panic Vulnerability in Linux Package: CVE-2022-50195
Summary
CVE-2022-50195: In the Linux kernel, the following vulnerability has been resolved: ARM: dts: qcom: replace gcc PXO with pxo_board fixed clock Replace gcc PXO phandle to pxo_board fixed clock declared in the dts. Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various platforms, including servers, desktops, and embedded systems. The kernel's stability and security are paramount, as vulnerabilities can lead to severe system failures or security breaches. This specific vulnerability affects the ARM architecture, particularly in the Qualcomm (qcom) device tree settings.
Vulnerability Detail
CVE-2022-50195 is a vulnerability in the Linux kernel that arises from an incorrect configuration in the device tree settings for ARM architecture. Specifically, the gcc PXO phandle was incorrectly set, leading to a situation where the gcc driver does not provide the PXO_SRC as it is a fixed clock. If any driver attempts to utilize this incorrect configuration, it results in a kernel panic, causing the system to crash. This vulnerability can severely impact system stability and availability, especially in production environments.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the Linux package to the fixed version.
Conclusion
CVE-2022-50195 represents a significant vulnerability in the Linux kernel that can lead to kernel panics due to misconfigured device tree settings. It is crucial for users to update their systems to the patched version to ensure stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software without requiring complex setups.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50195 is a vulnerability in the Linux kernel that can cause a kernel panic due to an incorrect device tree configuration for ARM architecture.
This vulnerability can lead to system crashes and instability if any driver attempts to use the incorrectly configured PXO_SRC clock.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
While there are no specific workarounds, it is advisable to monitor your system closely and plan for an update as soon as possible to mitigate risks.
Detailed information about CVE-2022-50195 can be found in the official CVE database and security advisories from the Linux kernel community.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
