#VU104647 NULL pointer dereference in Linux kernel - CVE-2022-49221

Vulnerability identifier: #VU104647

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49221

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the msm_dp_modeset_init() function in drivers/gpu/drm/msm/dp/dp_display.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/104074ebc0c3f358dd1ee944fbcde92c6e5a21dd
https://git.kernel.org/stable/c/413c62697b61226a236c8b1f5cd64dcf42bcc12f
https://git.kernel.org/stable/c/5e602f5156910c7b19661699896cb6e3fb94fab9
https://git.kernel.org/stable/c/9525b8bcae8b99188990b56484799cf4b1b43786
https://git.kernel.org/stable/c/fbba600f432a360b42452fee79d1fb35d3aa8aeb

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.