#VU104590 NULL pointer dereference in Linux kernel - CVE-2022-49494

Vulnerability identifier: #VU104590

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49494

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cadence_nand_dt_probe() function in drivers/mtd/nand/raw/cadence-nand-controller.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/069af5e27c1b0f7677ef76d8d3102e503ca4f80b
https://git.kernel.org/stable/c/0cfee868b89ffa945f3d535ee5c985cb40c5a0f8
https://git.kernel.org/stable/c/13b60d3dc84b47307669edb66b633b18466014b4
https://git.kernel.org/stable/c/81f1ddffdc22ca5789e33b9d4712914e302090c1
https://git.kernel.org/stable/c/a28ed09dafee20da51eb26452950839633afd824

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.