CVE-2022-41858: Null Pointer Dereference
A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sltxtimeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information.
Other sources
Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference flaw when a slip driver is in progress to detach in sltxtimeout in drivers/net/slip/slip.c. By sending a specially-crafted request to simulate slip network card from user-space of linux, a remote attacker could exploit this vulnerability to cause the system to crash or obtain internal kernel information.
— IBM
There are null-ptr-deref vulnerabilities in drivers/net/slip of linux that allow attacker to crash linux kernel by simulating slip network card from user-space of linux.
------------------------------------------
[Root cause]
When a slip driver is detaching, the slipclose() will act to cleanup necessary resources and sl->tty is set to NULL in slipclose(). Meanwhile, the packet we transmit is blocked, sltxtimeout() will be called. Although slipclose() and sltxtimeout() use sl->lock to synchronize, we dont judge whether sl->tty equals to NULL in sltxtimeout() and the null pointer dereference bug will happen.
(Thread 1) | (Thread 2) | slipclose() | spinlockbh(&sl->lock) | ... ... | sl->tty = NULL //(1) sltxtimeout() | spinunlockbh(&sl->lock) spinlock(&sl->lock); | ... | ... ttycharsinbuffer(sl->tty)| if (tty->ops->..) //(2) | ... | synchronizercu()
We set NULL to sl->tty in position (1) and dereference sl->tty in position (2).
------------------------------------------
— Red Hat
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-41858?
CVE-2022-41858 is classified as a high severity vulnerability due to its potential to crash the system or leak internal kernel information.
How do I fix CVE-2022-41858?
To mitigate CVE-2022-41858, update your Linux kernel to version 5.19 or later, or apply the specific patches provided by your distribution.
Which versions of the Linux kernel are affected by CVE-2022-41858?
CVE-2022-41858 affects Linux kernel versions prior to 5.19, specifically versions between 4.10 and 5.18.
Can CVE-2022-41858 be exploited remotely?
Yes, an attacker may exploit CVE-2022-41858 remotely if the system has the affected slip driver enabled.
What is the impact of CVE-2022-41858 on affected systems?
The impact of CVE-2022-41858 includes the potential for system crashes and unauthorized access to sensitive information within the kernel.