CyberSecBulletin
CVE-2022-48636NVD status: Modified

Linux: NULL Pointer Dereference

Published Updated By the CyberSecBulletin desk

CVE-2022-48636 is a high-severity NULL pointer dereference vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions d86b4267834e6d4af62e3073e48166e349ab1b70, 49f401a98b318761ca2e15d4c7869a20043fbed4, aaba5ff2742043705bc4c02fd0b2b246e2e16da1 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to d86b4267834e6d4af62e3073e48166e349ab1b70 or 49f401a98b318761ca2e15d4c7869a20043fbed4 or aaba5ff2742043705bc4c02fd0b2b246e2e16da1 or 2e473351400e3dd66f0b71eddcef82ee45a584c1, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.9.330 or 4.14.295 or 4.19.260 or 5.4.215, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux8e09f21574ea3028d5629e5de759e0b196c690c5 up to, but not including, d86b4267834e6d4af62e3073e48166e349ab1b70; 8e09f21574ea3028d5629e5de759e0b196c690c5 up to, but not including, 49f401a98b318761ca2e15d4c7869a20043fbed4; 8e09f21574ea3028d5629e5de759e0b196c690c5 up to, but not including, aaba5ff2742043705bc4c02fd0b2b246e2e16da1; 8e09f21574ea3028d5629e5de759e0b196c690c5 up to, but not including, 2e473351400e3dd66f0b71eddcef82ee45a584c1; 8e09f21574ea3028d5629e5de759e0b196c690c5 up to, but not including, f5fcc9d6d71d9ff7fdbdd4b89074e6e24fffc20b; 8e09f21574ea3028d5629e5de759e0b196c690c5 up to, but not including, d3a67c21b18f33c79382084af556557c442f12a6; 8e09f21574ea3028d5629e5de759e0b196c690c5 up to, but not including, 650a2e79d176db753654d3dde88e53a2033036ac; 8e09f21574ea3028d5629e5de759e0b196c690c5 up to, but not including, db7ba07108a48c0f95b74fabbfd5d63e924f992d; and 1 more rangesd86b4267834e6d4af62e3073e48166e349ab1b70, 49f401a98b318761ca2e15d4c7869a20043fbed4, aaba5ff2742043705bc4c02fd0b2b246e2e16da1, 2e473351400e3dd66f0b71eddcef82ee45a584c1, f5fcc9d6d71d9ff7fdbdd4b89074e6e24fffc20b, d3a67c21b18f33c79382084af556557c442f12a6
LinuxLinux Kernel2.6.25 up to, but not including, 4.9.330; 4.10 up to, but not including, 4.14.295; 4.15 up to, but not including, 4.19.260; 4.20 up to, but not including, 5.4.215; 5.5 up to, but not including, 5.10.146; 5.11 up to, but not including, 5.15.71; 5.16 up to, but not including, 5.19.12; 6.04.9.330, 4.14.295, 4.19.260, 5.4.215, 5.10.146, 5.15.71

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighCNA
CVSS 3.15.5MediumCISA (ADP)

Official description

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup Fix Oops in dasd_alias_get_start_dev() function caused by the pavgroup pointer being NULL. The pavgroup pointer is checked on the entrance of the function but without the lcu->lock being held. Therefore there is a race window between dasd_alias_get_start_dev() and _lcu_update() which sets pavgroup to NULL with the lcu->lock held. Fix by checking the pavgroup pointer with lcu->lock held.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How developers prevent this class of flaw

  • For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
  • Select a programming language that is not susceptible to these issues.
  • Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

More NULL Pointer Dereference vulnerabilities (CWE-476)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent NULL Pointer Dereference vulnerabilities

Spotted an error? Tell us.