CVE-2022-48972
📋 TL;DR
This CVE describes a NULL pointer dereference vulnerability in the Linux kernel's IEEE 802.15.4 (WPAN) subsystem. When adding a wireless personal area network interface, the kernel fails to initialize a linked list, which can cause a kernel panic when the interface is unregistered. This affects Linux systems using IEEE 802.15.4 wireless interfaces.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash and denial of service, potentially requiring physical access to restart affected devices.
Likely Case
System crash when IEEE 802.15.4 interfaces are added/removed, causing temporary denial of service until system restart.
If Mitigated
No impact if patched or if IEEE 802.15.4 interfaces are not used.
🎯 Exploit Status
Exploitation requires ability to add/remove IEEE 802.15.4 interfaces, typically requiring local access or specific wireless capabilities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions with commits 1831d4540406708e48239cf38fd9c3b7ea98e08f or later
Vendor Advisory: https://git.kernel.org/stable/c/1831d4540406708e48239cf38fd9c3b7ea98e08f
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing the fix commit. 2. Check distribution-specific security advisories. 3. Reboot system after kernel update.
🔧 Temporary Workarounds
Disable IEEE 802.15.4 subsystem
linuxPrevent loading of mac802154 module to avoid vulnerability
echo 'blacklist mac802154' >> /etc/modprobe.d/blacklist.conf
rmmod mac802154
🧯 If You Can't Patch
- Disable IEEE 802.15.4 interfaces if not needed
- Restrict user permissions to prevent interface manipulation
🔍 How to Verify
Check if Vulnerable:
Check if mac802154 module is loaded: lsmod | grep mac802154. If loaded and kernel version is vulnerable, system is at risk.Check Version:
uname -rVerify Fix Applied:
Check kernel version against distribution security advisory or verify fix commit is present: grep -r 'INIT_LIST_HEAD.*wpan_dev' /usr/src/linux/net/mac802154/iface.c📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages
- NULL pointer dereference in cfg802154_netdev_notifier_call
- System crash logs when adding/removing wireless interfaces
Network Indicators:
- Unexpected system reboots on devices with IEEE 802.15.4 interfaces
SIEM Query:
event.category:kernel AND (event.message:"NULL pointer dereference" OR event.message:"cfg802154_netdev_notifier_call")🔗 References
- https://git.kernel.org/stable/c/1831d4540406708e48239cf38fd9c3b7ea98e08f
- https://git.kernel.org/stable/c/42c319635c0cf7eb36eccac6cda76532f47b61a3
- https://git.kernel.org/stable/c/623918f40fa68e3bb21312a3fafb90f491bf5358
- https://git.kernel.org/stable/c/7410f4d1221bb182510b7778ab6eefa8b9b7102d
- https://git.kernel.org/stable/c/9980a3ea20de40c83817877106c909cb032692d2
- https://git.kernel.org/stable/c/a110287ef4a423980309490df632e1c1e73b3dc9
- https://git.kernel.org/stable/c/b3d72d3135d2ef68296c1ee174436efd65386f04
- https://git.kernel.org/stable/c/f00c84fb1635c27ba24ec5df65d5bd7d7dc00008
