CVE-2022-48703

What it actually does

Improper handling of a zero-length buffer returned by GDDV causes kmemdup to return ZERO_SIZE_PTR (0x10); subsequent access in data_vault_read triggers a NULL pointer dereference, resulting in a kernel crash.

Why it matters to the business

Local denial-of-service on Linux systems using the int340x thermal driver, potentially disrupting workloads on servers or desktops that rely on ACPI thermal interfaces; low exploitation likelihood given age and low EPSS, but still requires patching on affected kernels.

How an attack unfolds

An attacker with local access triggers the int340x_thermal driver to invoke GDDV, which returns a zero-length package; kmemdup then yields ZERO_SIZE_PTR, and data_vault_read dereferences address 0x10, crashing the kernel. No named threat actors or ransomware campaigns are associated.

How to fix it

Upgrade the Linux kernel to a version containing commit 39d5137085a6c37ace4680ee4d24020a4a03e7dc, which adds ZERO_OR_NULL_PTR checks before accessing data_vault.

How to confirm the fix worked

Verify the presence of commit 39d5137085a6c37ace4680ee4d24020a4a03e7dc in the kernel source or confirm the patched driver no longer dereferences 0x10 when a zero-length GDDV buffer is supplied; test with synthetic zero-length package inputs.

Typical attack path

1. Obtain local user access on a Linux system with int340x_thermal enabled
2. Interact with ACPI thermal interfaces to cause GDDV to return a zero-length buffer
3. Trigger data_vault_read path that performs unchecked access on ZERO_SIZE_PTR
4. Induce kernel NULL pointer dereference and system crash

How to detect it

Search kernel logs for BUG messages referencing NULL pointer dereference at address 0x10, data_vault_read, or int340x_thermal; correlate with thermal driver initialization or GDDV ACPI calls.

• BUG: kernel NULL pointer dereference, address: 0000000000000010
• data_vault_read
• int340x_thermal
• ZERO_SIZE_PTR

What your security team should do

• Apply the referenced kernel commit or newer stable release containing the fix
• Monitor for local privilege or thermal-interface access attempts on systems still running unpatched kernels
• Prioritize patching on systems exposing ACPI thermal interfaces to untrusted local users