CVE-2022-48824

What it actually does

Null pointer dereference in myrs_cleanup() when myrs_detect() encounters a hw_init() failure, because cs->disable_intr remains unset and is subsequently invoked.

Why it matters to the business

Kernel panic and immediate system crash on systems using the myrs SCSI driver when controller initialization fails, leading to downtime and loss of availability on affected hardware.

How an attack unfolds

An attacker with local access or the ability to induce a hardware initialization failure in the myrs driver causes the probe path to hit the uninitialized function pointer, triggering a NULL dereference and kernel crash.

How to fix it

Upgrade to fixed kernel versions: linux 5.16.7-1 or later on Debian 12/13; linux 5.4.0-9.12 or later, linux-aws 5.4.0-1005.5 or later, linux-azure 5.4.0-1006.6 or later, linux-gcp 5.4.0-1005.5 or later and corresponding 5.15 backports on Ubuntu 20.04 LTS.

How to confirm the fix worked

Verify running kernel version matches or exceeds the listed fixed packages for each distribution; attempt to load the myrs module under simulated init-failure conditions and confirm absence of NULL dereference panic.

Typical attack path

1. Gain local access or control hardware state to trigger myrs_probe failure
2. Force hw_init() to return non-zero so disable_intr stays NULL
3. Invoke myrs_cleanup() which calls the NULL pointer
4. Trigger kernel panic via NULL dereference

How to detect it

Inspect kernel logs for the strings 'myrs_cleanup' combined with 'NULL pointer dereference' and the call trace containing myrs_probe.cold; correlate with 'Failed to initialize Controller' messages from the myrs driver.

• BUG: kernel NULL pointer dereference, address: 0000000000000000
• myrs_cleanup+0xe4/0x150 [myrs]
• myrs_probe.cold+0x91/0x56a [myrs]
• Unknown Initialization Error 5A
• Failed to initialize Controller

What your security team should do

• Prioritize patching systems that expose the myrs driver to hardware that may fail initialization
• Apply the distribution-specific fixed kernel packages listed above
• Reboot after upgrade and monitor dmesg for successful myrs initialization