PT-2022-7621 · Linux+2 · Linux Kernel+2

Zheyu Ma · Published 2022-03-03 · Updated 2025-10-01 · CVE-2022-48908

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the fix in commit 5f394102ee27dbf05la4e283390cd8d1759dacea

Description The vulnerability is related to a null pointer dereference in the com20020pci probe() function during driver initialization. The issue arises because the com20020pci id table definition reveals that the ci field is empty for some devices, causing a null pointer dereference when initializing these devices. This can lead to a denial of service. The vulnerability affects all versions of the Linux kernel prior to the fix.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix, specifically to a version after the commit 5f394102ee27dbf05la4e283390cd8d1759dacea. As a temporary workaround, consider disabling the com20020pci probe() function until a patch is available. However, this may have implications for the functionality of the affected devices.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2024-07465

CVE-2022-48908

OESA-2024-2109

Affected Products

Astra Linux

Linux Kernel

Red Os

References · 56

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48908.json · Exploit
• https://git.kernel.org/stable/c/b1ee6b9340a38bdb9e5c90f0eac5b22b122c3049 · Patch
• https://git.kernel.org/stable/c/5f394102ee27dbf051a4e283390cd8d1759dacea · Patch
• https://git.kernel.org/stable/c/b838add93e1dd98210482dc433768daaf752bdef · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-42292 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-42311 · Security Note
• https://git.kernel.org/stable/c/8e3bc7c5bbf87e86e9cd652ca2a9166942d86206 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-48908 · Security Note
• https://git.kernel.org/stable/c/ea372aab54903310756217d81610901a8e66cb7d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-48891 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52899 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48908 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40901 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-43883 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-44944 · Security Note