PT-2024-11849 · Linux · Linux Kernel

Richard Palethorpe · Published 2022-12-01 · Updated 2024-10-25 · CVE-2022-48984

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.0.8-1-default

Description A crash in the slcan driver occurs due to a freed work crash. The LTP test pty03 causes this crash, resulting in a kernel NULL pointer dereference. The issue arises when the slcan's tx work is freed while being scheduled, and the work is not flushed under all circumstances.

Recommendations To resolve the issue, add an additional flush work() to slcan close() to ensure the work is flushed under all circumstances. Consider temporarily disabling the slcan driver until a patch is available. Restrict access to the vulnerable slcan module to minimize the risk of exploitation. Avoid using the tx work variable in the affected slcan driver until the issue is resolved.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2025-04439

CVE-2022-48984

Affected Products

Linux Kernel

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48984.json · Exploit
• https://bdu.fstec.ru/vul/2025-04439 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-48984 · Vendor Advisory
• https://git.kernel.org/stable/c/9e2709d58a14a10eb00d919acd7dec071c33f8c8 · Patch
• https://cve.org/CVERecord?id=CVE-2022-48984 · Security Note
• https://osv.dev/vulnerability/CVE-2022-48984 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48984 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48984 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48984 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48984 · Vendor Advisory
• https://git.kernel.org/stable/c/fb855e9f3b6b42c72af3f1eb0b288998fe0d5ebb · Patch
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://lore.kernel.org/linux-cve-announce/2024102147-CVE-2022-48984-ea9e@gregkh · Note
• https://access.redhat.com/security/cve/cve-2022-48984 · Note
• https://git.kernel.org/linus/fb855e9f3b6b42c72af3f1eb0b288998fe0d5ebb · Note