CVE-2022-49875

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49875

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE When using bpftool to pin {PROG, MAP, LINK} without FILE, segmentation fault will occur. The reson is that the lack of FILE will cause strlen to trigger NULL pointer dereference. The corresponding stacktrace is shown below: do_pin do_pin_any do_pin_fd mount_bpffs_for_pin strlen(name) <- NULL pointer dereference Fix it by adding validation to the common process.

References
Link Resource
https://git.kernel.org/stable/c/34de8e6e0e1f66e431abf4123934a2581cb5f133 Patch
https://git.kernel.org/stable/c/6dcdd1b68b7f9333d48d48fc77b75e7f235f6a4a Patch
https://git.kernel.org/stable/c/8c80b2fca4112d724dde477aed13f7b0510a2792 Patch
https://git.kernel.org/stable/c/da5161ba94c5e9182c301dd4f09c94f715c068bd Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
History

07 May 2025, 13:21

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/34de8e6e0e1f66e431abf4123934a2581cb5f133 - () https://git.kernel.org/stable/c/34de8e6e0e1f66e431abf4123934a2581cb5f133 - Patch
References () https://git.kernel.org/stable/c/6dcdd1b68b7f9333d48d48fc77b75e7f235f6a4a - () https://git.kernel.org/stable/c/6dcdd1b68b7f9333d48d48fc77b75e7f235f6a4a - Patch
References () https://git.kernel.org/stable/c/8c80b2fca4112d724dde477aed13f7b0510a2792 - () https://git.kernel.org/stable/c/8c80b2fca4112d724dde477aed13f7b0510a2792 - Patch
References () https://git.kernel.org/stable/c/da5161ba94c5e9182c301dd4f09c94f715c068bd - () https://git.kernel.org/stable/c/da5161ba94c5e9182c301dd4f09c94f715c068bd - Patch
CWE CWE-476

02 May 2025, 13:52

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpftool: Se corrige la desreferencia de puntero nulo al anclar {PROG, MAP, LINK} sin archivo. Al usar bpftool para anclar {PROG, MAP, LINK} sin archivo, se produce un fallo de segmentación. La razón es que la falta de archivo provoca que strlen active la desreferencia de puntero nulo. El seguimiento de pila correspondiente se muestra a continuación: do_pin do_pin_any do_pin_fd mount_bpffs_for_pin strlen(name) &lt;- Desreferencia de puntero nulo. Se corrige añadiendo validación al proceso común.

01 May 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 15:16

Updated : 2025-10-01 16:15

NVD link : CVE-2022-49875

Mitre link : CVE-2022-49875

CVE.ORG link : CVE-2022-49875

JSON object : View

Products Affected

linux

CWE
CWE-476

NULL Pointer Dereference