PT-2025-8625 · Linux+1 · Linux Kernel+1

Oleksij Rempel · Published 2025-02-26 · Updated 2025-02-27 · CVE-2022-49692

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference issue has been identified in the Linux kernel, specifically in the at803x driver for the AR9331 PHY. This issue occurs when the kernel attempts to configure the PHY interrupt without allocating the necessary private data, resulting in a kernel paging request error. The problem is not limited to the AR9331 PHY, as other PHYs such as QCA8081 and QCA9561 may also be affected.

Recommendations To resolve this issue, run the probe to allocate the necessary private data before configuring the PHY interrupt. As a temporary workaround, consider disabling the at803x config intr() function until a patch is available. Restrict access to the vulnerable at803x driver to minimize the risk of exploitation. Avoid using the phy request interrupt() function in the affected kernel versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2022-49692

Affected Products

Astra Linux

Linux Kernel

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49692.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-49692 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49692 · Security Note
• https://ubuntu.com/security/CVE-2022-49692 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49692 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49692 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49692 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49692 · Security Note
• https://git.kernel.org/stable/c/9926de7315be3d606cc011a305ad9adb9e8e14c9 · Patch
• https://git.kernel.org/stable/c/66fa352215e8455ba2e5f33793535795bd3e36ca · Patch
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://git.kernel.org/linus/9926de7315be3d606cc011a305ad9adb9e8e14c9 · Note
• https://twitter.com/CVEnew/status/1894592827406835851 · Twitter Post