CVE-2022-0617

What it actually does

Null pointer dereference in udf_file_write_iter triggered by a malicious UDF image causes kernel panic and system crash.

Why it matters to the business

Local users can trigger repeated system crashes leading to denial of service, unplanned downtime, and loss of availability on Linux systems handling UDF media.

How an attack unfolds

An attacker with local access prepares a crafted UDF image, mounts it, and invokes the udf_file_write_iter function to trigger the null dereference and crash the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit 7fc3b7c2981bbd1047916ade327beccb90994eee or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel contains the fix commit or is newer than 5.17-rc2; attempt to reproduce the crash with a test UDF image on a non-production system to confirm resolution.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Create or obtain a malicious UDF filesystem image
3. Mount the image and trigger write operations via udf_file_write_iter
4. Cause kernel null pointer dereference resulting in panic and reboot

How to detect it

Review kernel logs for UDF-related null pointer dereference oops messages, panic reports, and unexpected reboots on systems that mount UDF volumes; correlate with user activity on potentially malicious images.

What your security team should do

• Apply the kernel patch containing commit 7fc3b7c2981bbd1047916ade327beccb90994eee as soon as possible
• Restrict untrusted local user access to systems that process UDF images until patched
• Monitor for kernel oops and panic events related to UDF until remediation is complete