CVE-2022-50538
📋 TL;DR
This CVE-2022-50538 is a Linux kernel vulnerability in the VME subsystem where the fake_init() function fails to properly handle errors from __root_device_register(). This can lead to a NULL pointer dereference when unloading the module, potentially causing kernel crashes or denial of service. It affects Linux systems with the VME subsystem enabled.
💻 Affected Systems
- Linux kernel
⚠️ Risk & Real-World Impact
Worst Case
Kernel panic or system crash leading to denial of service, potentially requiring physical reboot of affected systems.
Likely Case
System instability or crash when unloading the VME module, causing temporary service disruption.
If Mitigated
Minimal impact if VME subsystem is not used or module loading is restricted.
🎯 Exploit Status
Requires local access and ability to load/unload kernel modules. Exploitation triggers during module unloading.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patches available in stable kernel trees (see references)
Vendor Advisory: https://git.kernel.org/stable/c/09be0e7ac5f9374b6f8de72c89ed67129af71f65
Restart Required: Yes
Instructions:
1. Update to patched kernel version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify VME module loads/unloads without errors.
🔧 Temporary Workarounds
Disable VME subsystem
linuxPrevent loading of VME kernel module if not required
echo 'blacklist vme' > /etc/modprobe.d/blacklist-vme.conf
rmmod vme
Restrict module loading
linuxPrevent unauthorized users from loading kernel modules
sysctl -w kernel.modules_disabled=1
echo 'kernel.modules_disabled=1' >> /etc/sysctl.conf
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized users from loading/unloading kernel modules
- Monitor system logs for VME module loading/unloading activities and kernel panic events
🔍 How to Verify
Check if Vulnerable:
Check if VME module is loaded: lsmod | grep vme. If loaded and kernel version is unpatched, system may be vulnerable.Check Version:
uname -rVerify Fix Applied:
After patching, attempt to load and unload VME module: modprobe vme && rmmod vme. Should complete without kernel errors.📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages
- NULL pointer dereference errors in dmesg
- VME module loading/unloading failures
Network Indicators:
- None - local vulnerability only
SIEM Query:
source="kernel" AND ("general protection fault" OR "null-ptr-deref" OR "vme" OR "fake_init")🔗 References
- https://git.kernel.org/stable/c/09be0e7ac5f9374b6f8de72c89ed67129af71f65
- https://git.kernel.org/stable/c/37d3de40c1ffb6a5e626bf46ff5ef5766c824e2c
- https://git.kernel.org/stable/c/4bc217b25ea81034fad8e33fd33e4659f086421d
- https://git.kernel.org/stable/c/60ff9bd4ffc87bace581e235a6728f5ac8e5071f
- https://git.kernel.org/stable/c/69b43937f14bdc3594f57f1a507a14f3d1187136
- https://git.kernel.org/stable/c/7bef797d707f1744f71156b21d41e3b8c946631f
- https://git.kernel.org/stable/c/a2a93546d414c7fe4862b87183fb737d1300d9d2
- https://git.kernel.org/stable/c/e831fdd60e5863ee03173baf5a0f7c5450b44381
- https://git.kernel.org/stable/c/f3f65c4177846c483bf009f8c512ab04b3c62466
