PT-2024-11823 · Linux+4 · Linux Kernel+4

Mel Gorman

·

Published

2022-10-13

·

Updated

2025-09-29

·

CVE-2022-48953

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description The issue is related to the Linux kernel's rtc-cmos driver, where the event handler registration ordering is incorrect. This leads to a NULL pointer dereference in rtc handler() on boot if the RTC fixed event happens to be active at the init time. The problem arises because acpi install fixed event handler() enables the event automatically on success, but it is called before the handler routine is ready to handle events. The rtc handler() function uses dev get drvdata() to get to the cmos object pointer, but the driver data pointer is only populated in cmos do probe(). To address this issue, the initialization ordering of the driver needs to be changed so that cmos wake setup() is always called after a successful cmos do probe() call.
Recommendations To resolve this issue, change the initialization ordering of the driver so that cmos wake setup() is always called after a successful cmos do probe() call. Additionally, modify cmos pnp probe() to call cmos do probe() after the initial if () statement used for computing the IRQ argument to be passed to cmos do probe(). At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALSA-2025_16880
ALT-PU-2023-1066
BDU:2025-01691
CVE-2022-48953
OESA-2024-2445
OPENSUSE-SU-2024_3983-1
OPENSUSE-SU-2024_3985-1
OPENSUSE-SU-2024_4131-1
SUSE-SU-2024:3983-1
SUSE-SU-2024:3985-1
SUSE-SU-2024:4082-1
SUSE-SU-2024:4131-1
SUSE-SU-2024:4364-1
SUSE-SU-2025:0834-1
SUSE-SU-2025_0834-1

Affected Products

Alt Linux
Astra Linux
Linux Kernel
Red Os
Suse