#VU90516 NULL pointer dereference in Linux kernel - CVE-2022-48692

Vulnerability identifier: #VU90516

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48692

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the srp_process_rsp() function in drivers/infiniband/ulp/srp/ib_srp.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/f022576aa03c2385ea7f2b27ee5b331e43abf624
https://git.kernel.org/stable/c/a8edd49c94b4b08019ed7d6dd794fca8078a4deb
https://git.kernel.org/stable/c/f2c70f56f762e5dc3b0d7dc438fbb137cb116413
https://git.kernel.org/stable/c/12f35199a2c0551187edbf8eb01379f0598659fa

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.