#VU104557 NULL pointer dereference in Linux kernel - CVE-2022-49319

Vulnerability identifier: #VU104557

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49319

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the arm_smmu_device_probe() function in drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/54c1e0e3bbcab2abe25b2874a43050ae5df87831
https://git.kernel.org/stable/c/54cf47da0c7532d151d76e5d63f5936191698c44
https://git.kernel.org/stable/c/b131fa8c1d2afd05d0b7598621114674289c2fbb
https://git.kernel.org/stable/c/db728a891f9177b044aaca89b678f6b5e24d5cc3
https://git.kernel.org/stable/c/fb0f1c5eb8d60b3e018ba7c87da249b52674ebe6

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.