PT-2022-7612 · Linux+1 · Linux Kernel+1

Evgenii Stepanov · Published 2022-01-26 · Updated 2025-03-24 · CVE-2022-48762

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the load unaligned zeropad function in the arm64 component of the Linux kernel. It involves the incorrect extraction of data and addr register indices from ex->type instead of ex->data. This can lead to the treatment of X0 as the address register and X4 as the data register, potentially causing the dereference of an arbitrary address and corruption of X4, resulting in arbitrary behavior within load unaligned zeropad and its caller. The problem is fixed by extracting both values from ex->data as originally intended. On an MTE-enabled QEMU image, this issue results in a crash due to a kernel NULL pointer dereference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2024-07404

CVE-2022-48762

Affected Products

Linux Kernel

Red Os

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48762.json · Exploit
• https://git.kernel.org/stable/c/3758a6c74e08bdc15ccccd6872a6ad37d165239a · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-48762 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-48762 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48762 · Security Note
• https://git.kernel.org/stable/c/47fe7a1c5e3e011eeb4ab79f2d54a794fdd1c3eb · Patch
• https://bdu.fstec.ru/vul/2024-07404 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48762 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-48762 · Security Note
• https://ubuntu.com/security/CVE-2022-48762 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48762 · Vendor Advisory
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5 · Note
• https://access.redhat.com/security/cve/CVE-2022-48762 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-kernel-lt-1301252 · Note
• https://twitter.com/CVEnew/status/1803772906616611273 · Twitter Post