CVE-2022-49010

Q: What is the severity of CVE-2022-49010?

CVE-2022-49010 has a CVSS score of 5.5 (MEDIUM). A NULL pointer dereference vulnerability in the Linux kernel's coretemp hardware monitoring driver allows local attackers to crash the kernel by triggering a CPU offline event after a failed initialization. This affects Linux systems using the coretemp driver for CPU temperature monitoring. The vulnerability requires local access to the system.

5.5 MEDIUM

Denial of Service

📋 TL;DR

A NULL pointer dereference vulnerability in the Linux kernel's coretemp hardware monitoring driver allows local attackers to crash the kernel by triggering a CPU offline event after a failed initialization. This affects Linux systems using the coretemp driver for CPU temperature monitoring. The vulnerability requires local access to the system.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with coretemp driver loaded (common on Intel systems with temperature monitoring). Requires triggering CPU offline event after initialization failure.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially causing data loss or service disruption.

🟠

Likely Case

System crash when CPU goes offline after coretemp initialization failure, requiring reboot to restore service.

🟢

If Mitigated

Minimal impact with proper patching; system remains stable during CPU state changes.

🌐 Internet-Facing: LOW - Requires local access to trigger, not remotely exploitable.

🏢 Internal Only: MEDIUM - Local users or processes could crash the system, affecting availability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger specific CPU state changes. No public exploit code identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits 070d5ea4a0592a37ad96ce7f7b6b024f90bb009f or related fixes

Vendor Advisory: https://git.kernel.org/stable/c/070d5ea4a0592a37ad96ce7f7b6b024f90bb009f

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. For custom kernels, apply the coretemp patch from kernel git. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable coretemp module

linux

Prevent loading of vulnerable coretemp driver

echo 'blacklist coretemp' >> /etc/modprobe.d/blacklist.conf
rmmod coretemp

Prevent CPU hotplug

linux

Disable CPU offline capability to prevent trigger condition

echo 0 > /sys/devices/system/cpu/cpuX/online (for each CPU)

🧯 If You Can't Patch

Restrict local user access to prevent malicious triggering
Monitor system logs for coretemp errors and CPU offline events

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if coretemp module is loaded: lsmod | grep coretemp && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and check dmesg for coretemp errors after CPU state changes

📡 Detection & Monitoring

Log Indicators:

kernel NULL pointer dereference messages
coretemp initialization errors
CPU offline events followed by crashes

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("NULL pointer dereference" OR "coretemp" OR "sysfs_remove_group")

📊 Metadata

CVE ID: CVE-2022-49010

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: October 21, 2024

Last Updated: October 24, 2024

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable coretemp module

Prevent CPU hotplug

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities