PT-2024-11781 · Linux+1 · Linux Kernel+1

Fan Ni · Published 2022-12-15 · Updated 2024-12-31 · CVE-2022-48707

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a null pointer dereference in the cxl/region component of the Linux kernel. This occurs when the cxl region decode reset function is called, and the ->reset() callback is invoked unconditionally, even if a decoder does not have a reset callback. The CXL specification allows a host bridge with a single root port to have no explicit HDM decoders, and the region driver assumes there are none, creating a special pass-through decoder instance without a commit/reset callback. This can cause a null pointer dereference in configurations with 1 Host Bridge, 1 Root Port, and one directly attached CXL type 3 device or multiple CXL type 3 devices attached to downstream ports of a switch. A kernel crash was observed when destroying the region and a pass-through decoder is reset. The issue can be reproduced by creating a region with a CXL setup and destroying it with the cxl destroy-region command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2025-04448

CVE-2022-48707

Affected Products

Linux Kernel

Red Os

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48707.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48707 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48707 · Security Note
• https://osv.dev/vulnerability/CVE-2022-48707 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-48707 · Vendor Advisory
• https://git.kernel.org/stable/c/a04c7d062b537ff787d00da95bdfe343260d4beb · Patch
• https://git.kernel.org/stable/c/4fa4302d6dc7de7e8e74dc7405611a2efb4bf54b · Patch
• https://bdu.fstec.ru/vul/2025-04448 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48707 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-48707 · Security Note
• https://ubuntu.com/security/CVE-2022-48707 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-kernel-lt-1511241 · Note
• https://access.redhat.com/security/cve/cve-2022-48707 · Note
• https://twitter.com/CVEnew/status/1792940570916360691 · Twitter Post
• https://t.me/cvenotify/80572 · Telegram Post