PT-2024-11848 · Linux+3 · Linux Kernel+3

Published 2022-12-07 · Updated 2025-02-11 · CVE-2022-48983

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc7-00103-gef4d3ea40565

Description The issue is related to a null pointer dereference bug in the io tctx exit cb() function. This bug can cause a kernel panic when the task exits to userspace. The problem arises because the addition of task work from io ring exit work() is not synchronized with the cancellation of all work items from exec. As a result, if io tctx exit cb() is queued while canceling all work items off exec and gets executed when the task exits to userspace, it can lead to a crash. The estimated number of potentially affected devices is not provided.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix for the null pointer dereference bug in the io tctx exit cb() function. As a temporary workaround, consider disabling the io uring component until a patch is available.

Exploit

Fix

NULL Pointer Dereference

Improper Locking

Weakness Enumeration

CWE-476

CWE-667

Related Identifiers

BDU:2025-01704

CVE-2022-48983

OPENSUSE-SU-2024_4315-1

OPENSUSE-SU-2024_4376-1

SUSE-SU-2024:4315-1

SUSE-SU-2024:4364-1

SUSE-SU-2024:4376-1

Affected Products

Astra Linux

Linux Kernel

Red Os

Suse

References · 973

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48983.json · Exploit
• https://cve.org/CVERecord?id=CVE-2022-48983 · Security Note
• https://git.kernel.org/stable/c/d91edca1943453aaaba4f380f6f364346222e5cf · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-48983 · Vendor Advisory
• https://git.kernel.org/stable/c/f895511de9d27fff71dad2c234ad53b4afd2b06c · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48983 · Vendor Advisory
• https://git.kernel.org/stable/c/998b30c3948e4d0b1097e639918c5cff332acac5 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:4364-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:4376-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:4315-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01704 · Security Note
• https://osv.dev/vulnerability/CVE-2022-48983 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48983 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48983 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48983 · Security Note