PT-2024-11823 · Linux+4 · Linux Kernel+4
Mel Gorman
·
Published
2022-10-13
·
Updated
2025-09-29
·
CVE-2022-48953
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to the Linux kernel's rtc-cmos driver, where the event handler registration ordering is incorrect. This leads to a NULL pointer dereference in
rtc handler() on boot if the RTC fixed event happens to be active at the init time. The problem arises because acpi install fixed event handler() enables the event automatically on success, but it is called before the handler routine is ready to handle events. The rtc handler() function uses dev get drvdata() to get to the cmos object pointer, but the driver data pointer is only populated in cmos do probe(). To address this issue, the initialization ordering of the driver needs to be changed so that cmos wake setup() is always called after a successful cmos do probe() call.Recommendations
To resolve this issue, change the initialization ordering of the driver so that
cmos wake setup() is always called after a successful cmos do probe() call. Additionally, modify cmos pnp probe() to call cmos do probe() after the initial if () statement used for computing the IRQ argument to be passed to cmos do probe(). At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linux Kernel
Red Os
Suse