#VU104587 NULL pointer dereference in Linux kernel - CVE-2022-49490

Vulnerability identifier: #VU104587

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49490

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mdp5_plane_atomic_check_with_state() function in drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c, within the mdp5_pipe_assign() and mdp5_pipe_release() functions in drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/04bef5f1ba8ea6d7c1c8f5f65e0395c62db59cb8
https://git.kernel.org/stable/c/19964dfb39bda4d7716a71009488f0668ecbcf52
https://git.kernel.org/stable/c/33dc5aac46e0fad8f5eb193e5906ed0eb6b66ceb
https://git.kernel.org/stable/c/49dc28b4b2e28ef7564e355c91487996c1cbebd7
https://git.kernel.org/stable/c/776f5c58bfe16cf322d71eeed3c5dda1eeac7e6b
https://git.kernel.org/stable/c/b2aa2c4efe93e2580d6a8774b04fe2b99756a322
https://git.kernel.org/stable/c/d59be579fa932c46b908f37509f319cbd4ca9a68

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.