CVE-2022-48879

What it actually does

NULL pointer dereference during EFI initialization error handling when runtime services are unsupported or disabled, because the workqueue was never allocated yet the cleanup code attempts unconditional destruction.

Why it matters to the business

Kernel crashes or panics on systems where EFI runtime services are absent, causing boot failures, reduced availability, and potential data loss in affected Linux and Android deployments; high ecosystem prevalence increases widespread exposure.

How an attack unfolds

An attacker triggers an EFI initialization failure path on a system lacking runtime services support, causing the kernel to dereference the unallocated workqueue pointer; listed threat actors have conducted related Linux kernel resource and memory corruption campaigns that could attempt to reach this code path during boot or driver load.

How to fix it

Upgrade Linux kernel to 4.19.270 or later, apply commit 585a0b2b3ae7903c6abee3087d09c69e955a7794, and update affected Android packages/apps/Nfc to versions released on or after 2021-07-01 for branches 8.1, 9, 10, and 11.

How to confirm the fix worked

Confirm kernel version is at or above the fixed release, verify the EFI init error path no longer contains unconditional workqueue destruction, and test EFI initialization failure scenarios in a lab environment to ensure no NULL dereference occurs.

Typical attack path

1. Identify or force a system configuration where EFI runtime services are disabled or unsupported
2. Trigger an EFI initialization error condition
3. Cause the error-path cleanup to execute without an allocated workqueue
4. Trigger NULL pointer dereference leading to kernel panic or memory corruption

How to detect it

Review kernel boot logs and dmesg for NULL pointer dereference faults in EFI initialization paths; correlate with systems reporting disabled runtime services; examine crash dumps for workqueue-related symbols during early init failure.

What your security team should do

• Apply kernel and Android fixes immediately given the memory corruption family and listed exploitation campaigns
• Prioritize systems without EFI runtime services for urgent patching
• Monitor for post-fix boot stability in affected environments