CVE-2022-48750

What it actually does

NULL pointer dereference in the nct6775 hwmon driver's clear_caseopen function when the hwmon device is passed instead of the platform device, because platform data is not initialized on the hwmon device.

Why it matters to the business

Unexpected kernel crashes on systems using NCT6775-family sensors when chassis intrusion alarms are cleared, causing downtime and potential loss of monitoring for affected hardware.

How an attack unfolds

An attacker with local access writes to the chassis intrusion clear attribute exposed by the nct6775 hwmon driver, triggering the NULL dereference path that was not guarded before the fix was applied.

How to fix it

Upgrade the Linux kernel to version 5.16.5 or later, or apply the commit cfb7d12f2e4a4d694f49e9b4ebb352f7b67cdfbb that stores sio_data in struct nct6775_data.

How to confirm the fix worked

Confirm the running kernel contains commit cfb7d12f2e4a4d694f49e9b4ebb352f7b67cdfbb or is at least 5.16.5; test that writing to the clear_caseopen attribute no longer produces a NULL dereference oops.

Typical attack path

1. Identify a system exposing nct6775 hwmon sensors via sysfs
2. Locate the clear_caseopen attribute under the hwmon device
3. Write a value to trigger the alarm-clear handler
4. Cause kernel NULL pointer dereference and oops

How to detect it

Search kernel logs and dmesg for oops messages containing 'clear_caseopen' and 'nct6775' or 'NULL pointer dereference' near hwmon write paths; correlate with user processes writing to /sys/class/hwmon paths on affected hardware.

What your security team should do

• Prioritize kernel upgrades on systems with NCT6775 hardware within normal patch windows
• Monitor kernel logs for nct6775-related NULL pointer oops until patches are deployed
• Restrict unprivileged local users from writing to hwmon sysfs attributes if upgrades are delayed