#VU104621 NULL pointer dereference in Linux kernel - CVE-2022-49060

Vulnerability identifier: #VU104621

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49060

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the smc_pnet_find_ib() function in net/smc/smc_pnet.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/22025513ced3d599ee8b24169141c95cf2467a4a
https://git.kernel.org/stable/c/35b91e49bc80ca944a8679c3b139ddaf2f8eea0f
https://git.kernel.org/stable/c/3a523807f01455fe9a0c1a433f27cd4411ee400f
https://git.kernel.org/stable/c/a05f5e26cb8bb4d07e0595545fcad1bb406f0085
https://git.kernel.org/stable/c/d22f4f977236f97e01255a80bca2ea93a8094fc8

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.