#VU104553 NULL pointer dereference in Linux kernel - CVE-2022-49295

Vulnerability identifier: #VU104553

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49295

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nbd_cleanup() function in drivers/block/nbd.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/013a79f1b5c89290e2e97f1ebf14b14e0cf5fe5c
https://git.kernel.org/stable/c/06c4da89c24e7023ea448cadf8e9daf06a0aae6e
https://git.kernel.org/stable/c/1be608e1ee1f222464b2856bda9b85ab5184a33e
https://git.kernel.org/stable/c/3d5da1ffba3388c2ae2e6c598855a4d887d3bf79
https://git.kernel.org/stable/c/6f505bbb8063fd3a238a4239d2d8c165e5279f6f
https://git.kernel.org/stable/c/8a1435c862ea09b06be7acda325128dc08458e25
https://git.kernel.org/stable/c/c0868f6e728c3c28bef0e8bee89d2daf86a8bbca
https://git.kernel.org/stable/c/cbeafa7a79d08ecdb55f8f1d41a11323d0f709db

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.