PT-2024-11794 · Linux+2 · Linux Kernel+2

Paweł Marciniak · Published 2022-01-23 · Updated 2024-11-04 · CVE-2022-48750

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel version 5.16.2-200.fc35.x86 64

Description The issue is related to a NULL pointer dereference in the Linux kernel, specifically in the hwmon component. This occurs when the clear caseopen() function is called with the wrong device type, leading to a crash. The problem arises because the device passed to clear caseopen() is the hwmon device, not the platform device, and the platform data is not set in the hwmon device. To resolve this, the pointer to sio data should be stored in the struct nct6775 data and retrieved from there when needed.

Recommendations To fix the issue, update the Linux kernel to a version where this vulnerability has been resolved. Ensure that the sio data pointer is correctly stored in the struct nct6775 data to prevent the NULL pointer dereference. As a temporary workaround, consider disabling the clear caseopen() function until a patch is available.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2025-14256

CVE-2022-48750

Affected Products

Astra Linux

Linux Kernel

Red Os

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48750.json · Exploit
• https://git.kernel.org/stable/c/cfb7d12f2e4a4d694f49e9b4ebb352f7b67cdfbb · Patch
• https://git.kernel.org/stable/c/79da533d3cc717ccc05ddbd3190da8a72bc2408b · Patch
• https://bdu.fstec.ru/vul/2025-14256 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48750 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-48750 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48750 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-48750 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-48750 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-48750 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48750 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-kernel-lt-25-09-24 · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5 · Note
• https://lore.kernel.org/linux-cve-announce/2024062005-CVE-2022-48750-20d1@gregkh · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note