Cloudanix VulnDB

CVE-2022-48850

Medium · 5.5

CVSS

5.5

EPSS

0.2%

Published

Jul 16, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in the Linux kernel can cause computers to crash when network devices are turned off or the system shuts down.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability is a NULL pointer dereference in the Linux kernel's net-sysfs speed_show function that occurs when a netdevice has already been removed during shutdown or bring-down, leading to a kernel panic via dma_pool_alloc and related call paths.

Why it matters to the business

Systems may crash or become unavailable during routine shutdown, reboot, or network interface changes, disrupting operations and requiring manual intervention or recovery on affected Linux deployments.

How an attack unfolds

An attacker with local access triggers netdevice removal or system shutdown while a process reads the sysfs speed attribute, causing the kernel to dereference a NULL pointer in the ethtool link settings path and panic the system.

How to fix it

Update the Linux kernel to a version containing commit a7b9ab04c5932dee7ec95e0abc58b0df350c0dd2 which adds a presence check for the netdevice in speed_show before accessing it.

How to confirm the fix worked

Verify the running kernel includes the fix commit or later; reproduce shutdown sequences while monitoring sysfs access to confirm no panic occurs; check dmesg for absence of the described NULL dereference stack trace.

Typical attack path

  1. Obtain local user access on a Linux system with the vulnerable kernel
  2. Trigger netdevice shutdown or system reboot sequence
  3. Access the sysfs path for network device speed while the device is being removed
  4. Cause kernel NULL pointer dereference and panic

How to detect it

Search kernel logs and crash dumps for stack traces involving speed_show, mlx5_core cmd_exec, dma_pool_alloc, and netdevice state checks during shutdown; look for BUG: unable to handle kernel NULL pointer dereference messages tied to sysfs reads.

  • BUG: unable to handle kernel NULL pointer dereference at (null)
  • IP: [<ffffffff8ee11acb>] dma_pool_alloc+0x1ab/0x280
  • speed_show at ffffffff8f277208
  • dev_attr_show at ffffffff8f0b70e3
  • net_device.state = 0x5 (__LINK_STATE_START| __LINK_STATE_NOCARRIER)

What your security team should do

  • Apply the kernel patch containing a7b9ab04c5932dee7ec95e0abc58b0df350c0dd2 as soon as possible on all affected systems
  • Prioritize updates on high-availability or frequently rebooted hosts
  • Monitor kernel crash logs for similar NULL pointer dereference patterns during shutdown
  • Test patched kernels in staging environments before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: net-sysfs: add check for netdevice being present to speed_show When bringing down the netdevice or system shutdown, a panic can be triggered while accessing the sysfs path because the device is already removed. [ 755.549084] mlx5_core 0000:12:00.1: Shutdown was called [ 756.404455] mlx5_core 0000:12:00.0: Shutdown was called ... [ 757.937260] BUG: unable to handle kernel NULL pointer dereference at (null) [ 758.031397] IP: [<ffffffff8ee11acb>] dma_pool_alloc+0x1ab/0x280 crash> bt ... PID: 12649 TASK: ffff8924108f2100 CPU: 1 COMMAND: "amsd" ... #9 [ffff89240e1a38b0] page_fault at ffffffff8f38c778 [exception RIP: dma_pool_alloc+0x1ab] RIP: ffffffff8ee11acb RSP: ffff89240e1a3968 RFLAGS: 00010046 RAX: 0000000000000246 RBX: ffff89243d874100 RCX: 0000000000001000 RDX: 0000000000000000 RSI: 0000000000000246 RDI: ffff89243d874090 RBP: ffff89240e1a39c0 R8: 000000000001f080 R9: ffff8905ffc03c00 R10: ffffffffc04680d4 R11: ffffffff8edde9fd R12: 00000000000080d0 R13: ffff89243d874090 R14: ffff89243d874080 R15: 0000000000000000 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #10 [ffff89240e1a39c8] mlx5_alloc_cmd_msg at ffffffffc04680f3 [mlx5_core] #11 [ffff89240e1a3a18] cmd_exec at ffffffffc046ad62 [mlx5_core] #12 [ffff89240e1a3ab8] mlx5_cmd_exec at ffffffffc046b4fb [mlx5_core] #13 [ffff89240e1a3ae8] mlx5_core_access_reg at ffffffffc0475434 [mlx5_core] #14 [ffff89240e1a3b40] mlx5e_get_fec_caps at ffffffffc04a7348 [mlx5_core] #15 [ffff89240e1a3bb0] get_fec_supported_advertised at ffffffffc04992bf [mlx5_core] #16 [ffff89240e1a3c08] mlx5e_get_link_ksettings at ffffffffc049ab36 [mlx5_core] #17 [ffff89240e1a3ce8] __ethtool_get_link_ksettings at ffffffff8f25db46 #18 [ffff89240e1a3d48] speed_show at ffffffff8f277208 #19 [ffff89240e1a3dd8] dev_attr_show at ffffffff8f0b70e3 #20 [ffff89240e1a3df8] sysfs_kf_seq_show at ffffffff8eedbedf #21 [ffff89240e1a3e18] kernfs_seq_show at ffffffff8eeda596 #22 [ffff89240e1a3e28] seq_read at ffffffff8ee76d10 #23 [ffff89240e1a3e98] kernfs_fop_read at ffffffff8eedaef5 #24 [ffff89240e1a3ed8] vfs_read at ffffffff8ee4e3ff #25 [ffff89240e1a3f08] sys_read at ffffffff8ee4f27f #26 [ffff89240e1a3f50] system_call_fastpath at ffffffff8f395f92 crash> net_device.state ffff89443b0c0000 state = 0x5 (__LINK_STATE_START| __LINK_STATE_NOCARRIER) To prevent this scenario, we also make sure that the netdevice is present.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 5.10.106-1
Debian:12 linux 0 5.16.18-1
Debian:13 linux 0 5.16.18-1
Linux Kernel 0 4.9.307
Linux Kernel 2.6.33 4.9.307
SUSE:Linux Enterprise High Availability Extension 12 SP5 kernel-default 0 4.12.14-122.225.1
SUSE:Linux Enterprise High Availability Extension 15 SP5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Live Patching 12 SP5 kernel-default 0 4.12.14-122.225.1
SUSE:Linux Enterprise Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_59 0 1-8.3.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-livepatch-SLE15-SP5-RT_Update_18 0 1-150500.11.3.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_17 0 1-150500.11.3.1
SUSE:Linux Enterprise Micro 5.5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Micro 5.5 kernel-default-base 0 5.14.21-150500.55.73.1.150500.6.33.8
SUSE:Linux Enterprise Micro 5.5 kernel-rt 0 5.14.21-150500.13.64.1
SUSE:Linux Enterprise Micro 5.5 kernel-source-rt 0 5.14.21-150500.13.64.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-64kb 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-default-base 0 5.14.21-150500.55.73.1.150500.6.33.8
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-source 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-zfcpdump 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-docs 0 5.14.21-150500.55.73.2
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-obs-build 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-source 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-syms 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Legacy 15 SP5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-azure 0 5.14.21-150500.33.63.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-source-azure 0 5.14.21-150500.33.63.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-syms-azure 0 5.14.21-150500.33.63.1
SUSE:Linux Enterprise Real Time 12 SP5 kernel-rt 0 4.12.14-10.197.1
SUSE:Linux Enterprise Real Time 12 SP5 kernel-rt_debug 0 4.12.14-10.197.1
SUSE:Linux Enterprise Real Time 12 SP5 kernel-source-rt 0 4.12.14-10.197.1
SUSE:Linux Enterprise Real Time 12 SP5 kernel-syms-rt 0 4.12.14-10.197.1
SUSE:Linux Enterprise Server 12 SP5 kernel-azure 0 4.12.14-16.194.1
SUSE:Linux Enterprise Server 12 SP5 kernel-default 0 4.12.14-122.225.1
SUSE:Linux Enterprise Server 12 SP5 kernel-source 0 4.12.14-122.225.1
SUSE:Linux Enterprise Server 12 SP5 kernel-source-azure 0 4.12.14-16.194.1
SUSE:Linux Enterprise Server 12 SP5 kernel-syms 0 4.12.14-122.225.1
SUSE:Linux Enterprise Server 12 SP5 kernel-syms-azure 0 4.12.14-16.194.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP5 kernel-azure 0 4.12.14-16.194.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP5 kernel-default 0 4.12.14-122.225.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP5 kernel-source 0 4.12.14-122.225.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP5 kernel-source-azure 0 4.12.14-16.194.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP5 kernel-syms 0 4.12.14-122.225.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP5 kernel-syms-azure 0 4.12.14-16.194.1
SUSE:Linux Enterprise Software Development Kit 12 SP5 kernel-docs 0 4.12.14-122.225.2
SUSE:Linux Enterprise Software Development Kit 12 SP5 kernel-obs-build 0 4.12.14-122.225.1
SUSE:Linux Enterprise Workstation Extension 12 SP5 kernel-default 0 4.12.14-122.225.1
SUSE:Linux Enterprise Workstation Extension 15 SP5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Real Time Module 15 SP5 kernel-rt 0 5.14.21-150500.13.64.1
SUSE:Real Time Module 15 SP5 kernel-rt_debug 0 5.14.21-150500.13.64.1
SUSE:Real Time Module 15 SP5 kernel-source-rt 0 5.14.21-150500.13.64.1
SUSE:Real Time Module 15 SP5 kernel-syms-rt 0 5.14.21-150500.13.64.1
Ubuntu:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux 0 4.15.0-184.194
Ubuntu:18.04:LTS linux-aws 0 4.15.0-1133.143
Ubuntu:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:18.04:LTS linux-aws-5.4 0 5.4.0-1078.84~18.04.1
Ubuntu:18.04:LTS linux-azure 0 No fix
Ubuntu:18.04:LTS linux-azure-4.15 0 4.15.0-1142.156
Ubuntu:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure-5.4 0 5.4.0-1083.87~18.04.1
Ubuntu:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:18.04:LTS linux-gcp 0 No fix
Ubuntu:18.04:LTS linux-gcp-4.15 0 4.15.0-1127.142
Ubuntu:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:18.04:LTS linux-gcp-5.4 0 5.4.0-1078.84~18.04.1
Ubuntu:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:18.04:LTS linux-hwe 0 No fix
Ubuntu:18.04:LTS linux-hwe-5.4 0 5.4.0-117.132~18.04.1
Ubuntu:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-ibm-5.4 0 5.4.0-1028.32~18.04.1
Ubuntu:18.04:LTS linux-kvm 0 4.15.0-1119.123
Ubuntu:18.04:LTS linux-oem 0 No fix
Ubuntu:18.04:LTS linux-oracle 0 4.15.0-1098.108
Ubuntu:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.4 0 5.4.0-1076.83~18.04.1
Ubuntu:18.04:LTS linux-raspi-5.4 0 5.4.0-1065.75~18.04.1
Ubuntu:20.04:LTS linux 0 No fix
Ubuntu:20.04:LTS linux 0 5.4.0-117.132
Ubuntu:20.04:LTS linux-aws 0 No fix
Ubuntu:20.04:LTS linux-aws 0 5.4.0-1078.84
Ubuntu:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 5.15.0-1014.18~20.04.1
Ubuntu:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure 0 No fix
Ubuntu:20.04:LTS linux-azure 0 5.4.0-1083.87
Ubuntu:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 5.15.0-1007.8~20.04.1
Ubuntu:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 5.15.0-1019.24~20.04.1.1
Ubuntu:20.04:LTS linux-bluefield 0 No fix
Ubuntu:20.04:LTS linux-bluefield 0 5.4.0-1040.44
Ubuntu:20.04:LTS linux-gcp 0 No fix
Ubuntu:20.04:LTS linux-gcp 0 5.4.0-1078.84
Ubuntu:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 5.15.0-1006.9~20.04.1
Ubuntu:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:20.04:LTS linux-gke 0 No fix
Ubuntu:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 5.4.0-1046.48
Ubuntu:20.04:LTS linux-gkeop-5.15 0 5.15.0-1003.5~20.04.2
Ubuntu:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 5.4.0-1026.29
Ubuntu:20.04:LTS linux-ibm-5.15 0 5.15.0-1033.36~20.04.1
Ubuntu:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 5.15.0-1008.11~20.04.1
Ubuntu:20.04:LTS linux-iot 0 No fix
Ubuntu:20.04:LTS linux-iot 0 5.4.0-1004.6
Ubuntu:20.04:LTS linux-kvm 0 No fix
Ubuntu:20.04:LTS linux-kvm 0 5.4.0-1068.72
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 5.4.0-1076.83
Ubuntu:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 5.15.0-1007.9~20.04.1
Ubuntu:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 5.4.0-1065.75
Ubuntu:20.04:LTS linux-raspi2 0 No fix
Ubuntu:20.04:LTS linux-riscv 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 5.15.0-1015.17~20.04.1
Ubuntu:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 5.4.0-1020.24
Ubuntu:22.04:LTS linux 0 5.15.0-25.25
Ubuntu:22.04:LTS linux-allwinner-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws 0 5.15.0-1004.6
Ubuntu:22.04:LTS linux-aws-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws-6.2 0 No fix
Ubuntu:22.04:LTS linux-aws-6.5 0 6.5.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-aws-6.8 0 6.8.0-1009.9~22.04.2
Ubuntu:22.04:LTS linux-azure 0 5.15.0-1003.4
Ubuntu:22.04:LTS linux-azure-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-6.2 0 No fix
Ubuntu:22.04:LTS linux-azure-6.5 0 6.5.0-1007.7~22.04.1
Ubuntu:22.04:LTS linux-azure-6.8 0 6.8.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-azure-fde 0 5.15.0-1019.24.1
Ubuntu:22.04:LTS linux-azure-fde-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 5.15.0-1003.6
Ubuntu:22.04:LTS linux-gcp-5.19 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.5 0 6.5.0-1010.10~22.04.3
Ubuntu:22.04:LTS linux-gcp-6.8 0 6.8.0-1010.11~22.04.1
Ubuntu:22.04:LTS linux-gke 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-gkeop 0 5.15.0-1001.2
Ubuntu:22.04:LTS linux-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.8 0 6.8.0-38.38~22.04.1
Ubuntu:22.04:LTS linux-ibm 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 No fix
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 5.15.0-1021.26
Ubuntu:22.04:LTS linux-intel-iotg 0 5.15.0-1004.6
Ubuntu:22.04:LTS linux-kvm 0 5.15.0-1004.4
Ubuntu:22.04:LTS linux-lowlatency 0 5.15.0-24.24
Ubuntu:22.04:LTS linux-lowlatency-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.8 0 6.8.0-38.38.1~22.04.2
Ubuntu:22.04:LTS linux-nvidia 0 5.15.0-1005.5
Ubuntu:22.04:LTS linux-nvidia-6.2 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.5 0 6.5.0-1004.4
Ubuntu:22.04:LTS linux-nvidia-6.8 0 6.8.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-oem-5.17 0 No fix
Ubuntu:22.04:LTS linux-oem-6.0 0 No fix
Ubuntu:22.04:LTS linux-oem-6.1 0 No fix
Ubuntu:22.04:LTS linux-oem-6.5 0 6.5.0-1003.3
Ubuntu:22.04:LTS linux-oracle 0 5.15.0-1002.4
Ubuntu:22.04:LTS linux-oracle-6.5 0 6.5.0-1013.13~22.04.4
Ubuntu:22.04:LTS linux-oracle-6.8 0 6.8.0-1006.6~22.04.3
Ubuntu:22.04:LTS linux-raspi 0 5.15.0-1005.5
Ubuntu:22.04:LTS linux-realtime 0 No fix
Ubuntu:22.04:LTS linux-riscv 0 No fix
Ubuntu:22.04:LTS linux-riscv-5.19 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.5 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.8 0 6.8.0-38.38.1~22.04.1
Ubuntu:22.04:LTS linux-starfive-5.19 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.2 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.5 0 6.5.0-1007.8~22.04.1

Related vulnerabilities