PT-2025-18523 · Linux+1 · Linux Kernel+1

Published 2025-05-01 · Updated 2025-05-02 · CVE-2022-49806

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A potential null pointer dereference issue has been identified in the Linux kernel, specifically in the sparx stats init() and sparx5 start() functions. The sparx stats init() function calls create singlethread workqueue() without checking the return value, which may be NULL, leading to a null pointer dereference. This occurs when queue delayed work() is called, followed by queue delayed work on() and queue delayed work(), ultimately accessing wq->flags and causing a null pointer dereference. The issue is resolved by checking the return value and returning -ENOMEM if it is NULL.

Recommendations For the Linux kernel, check the return value of create singlethread workqueue() in sparx stats init() and sparx5 start() and return -ENOMEM if it is NULL to prevent null pointer dereferences. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2022-49806

Affected Products

Astra Linux

Linux Kernel

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49806.json · Exploit
• https://git.kernel.org/stable/c/456327e565dc49d18b2f595f39f47df8a36f1057 · Patch
• https://ubuntu.com/security/CVE-2022-49806 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49806 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49806 · Vendor Advisory
• https://git.kernel.org/stable/c/639f5d006e36bb303f525d9479448c412b720c39 · Patch
• https://osv.dev/vulnerability/CVE-2022-49806 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49806 · Security Note
• https://git.kernel.org/stable/c/80e590aeb132887102c3fa79d99b338f099dc952 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-49806 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49806 · Security Note
• https://git.kernel.org/linus/639f5d006e36bb303f525d9479448c412b720c39 · Note
• https://twitter.com/CVEnew/status/1918014625947242889 · Twitter Post
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note