CVE-2022-48824 – A NULL pointer dereference vulnerability exists... (How to Fix)

Q: What is the severity of CVE-2022-48824?

CVE-2022-48824 has a CVSS score of 5.5 (MEDIUM). A NULL pointer dereference vulnerability exists in the Linux kernel's myrs SCSI driver. When hardware initialization fails, the driver attempts to call a NULL function pointer, causing a kernel crash. This affects systems using the myrs driver for Mylex RAID controllers.

📋 TL;DR

A NULL pointer dereference vulnerability exists in the Linux kernel's myrs SCSI driver. When hardware initialization fails, the driver attempts to call a NULL function pointer, causing a kernel crash. This affects systems using the myrs driver for Mylex RAID controllers.

💻 Affected Systems

Products:

Linux kernel with myrs SCSI driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if the myrs driver is loaded (typically for Mylex RAID controllers). Most systems don't use this driver by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially causing data loss or corruption if the system is performing critical operations.

🟠

Likely Case

System crash during driver initialization, preventing the RAID controller from functioning and requiring a reboot.

🟢

If Mitigated

No impact if the driver isn't loaded or the hardware initialization succeeds.

🌐 Internet-Facing: LOW - This is a local kernel driver vulnerability requiring local access or ability to trigger driver initialization.

🏢 Internal Only: MEDIUM - Could be triggered by local users or during system boot, causing service disruption.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to trigger the driver's error path, typically through hardware interaction or driver loading.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 0e42c4a3d732, 1d6cd26605b4, 4db09593af0b, 5c5ceea00c8c, 6207f35c213f

Vendor Advisory: https://git.kernel.org/stable/c/0e42c4a3d732517edc3766dd45a14e60d29dd929

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix. 2. Check with your distribution for specific patched kernel versions. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable myrs driver

linux

Prevent loading of the vulnerable myrs driver module

echo 'blacklist myrs' >> /etc/modprobe.d/blacklist-myrs.conf
rmmod myrs

🧯 If You Can't Patch

Ensure myrs driver is not loaded (check with 'lsmod | grep myrs')
Avoid using Mylex RAID controllers that require the myrs driver

🔍 How to Verify

Check if Vulnerable:

Check if myrs module is loaded: 'lsmod | grep myrs' and check kernel version against patched versions

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and myrs module loads without crash during hardware initialization

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages mentioning myrs_cleanup
NULL pointer dereference in kernel logs
Failed to initialize Controller messages

Network Indicators:

None - this is a local driver issue

SIEM Query:

kernel.panic OR "NULL pointer dereference" AND myrs

📊 Metadata

CVE ID: CVE-2022-48824

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: July 16, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-48824, you might also want to check these: