CVE-2022-4127

What it actually does

NULL pointer dereference in io_files_update_with_index_alloc allows a local process to trigger a kernel crash.

Why it matters to the business

Local users can force unplanned system reboots and service interruptions on affected Linux systems.

How an attack unfolds

An attacker with local shell access crafts input that reaches the vulnerable function, dereferences a NULL pointer, and causes an immediate kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing commit d785a773bed966a75ca1f11d108ae1897189975b or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel contains commit d785a773bed966a75ca1f11d108ae1897189975b; attempt reproduction of the crash condition on a test system before and after the update.

Typical attack path

1. Obtain a local shell on the target system
2. Execute or compile a program that invokes io_files_update_with_index_alloc with crafted parameters
3. Trigger the NULL dereference to induce kernel panic and denial of service

How to detect it

Search kernel logs and crash dumps for oops or panic messages that include io_files_update_with_index_alloc; correlate with process creation events around the crash time.

• io_files_update_with_index_alloc
• kernel: NULL pointer dereference
• RIP:.*io_files_update_with_index_alloc

What your security team should do

• Apply the kernel patch containing commit d785a773bed966a75ca1f11d108ae1897189975b on all affected systems
• Prioritize systems that allow untrusted local accounts
• Monitor for kernel oops or panic events referencing io_files_update_with_index_alloc