CVE-2022-50875

What it actually does

Null pointer dereference occurs in Linux kernel device tree overlay code when kasprintf() allocation fails, leaving fn_1 or fn_2 NULL before strcmp() is called in find_dup_cset_node_entry() or find_dup_cset_prop().

Why it matters to the business

Kernel panic or denial of service on systems performing device tree overlay operations, potentially disrupting boot or runtime device configuration on affected Linux deployments.

How an attack unfolds

An attacker triggers the vulnerable code path during device tree overlay application while simultaneously inducing memory pressure to cause kasprintf() failure, resulting in the null dereference and system crash.

How to fix it

Apply the upstream fix by updating the Linux kernel to include commit 9ec5781879b4535ad59b5354b385825378e45618 or later; rebuild and deploy the patched kernel image across affected systems.

How to confirm the fix worked

Confirm the presence of commit 9ec5781879b4535ad59b5354b385825378e45618 in the kernel source tree or verify the fixed versions of find_dup_cset_node_entry and find_dup_cset_prop contain explicit NULL checks after kasprintf.

Typical attack path

1. Identify a target system using device tree overlays
2. Trigger overlay application via dtbo load or equivalent mechanism
3. Induce memory allocation failure at the kasprintf call site
4. Cause strcmp on NULL pointer leading to kernel oops or panic

How to detect it

Review kernel logs and crash dumps for oops or panic messages containing find_dup_cset_node_entry, find_dup_cset_prop, or kasprintf failure paths; correlate with device tree overlay load events.

• find_dup_cset_node_entry
• find_dup_cset_prop
• kasprintf.*NULL
• strcmp.*NULL pointer dereference

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all production systems using device tree overlays
• Monitor for kernel oops logs referencing the affected overlay functions
• Test patched kernels in staging environments before broad deployment