NULL pointer dereference in Linux kernel - CVE-2022-25258
Published: March 13, 2022
Vulnerability details
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error drivers/usb/gadget/composite.c in the Linux kernel. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). A local user can run a specially crafted program to trigger memory corruption and perform a denial of service (DoS) attack.
Affected software
Debian Linux
SUSE Linux Enterprise Micro
Anolis OS
Google Android
Ubuntu
Slackware Linux
SUSE Linux Enterprise Real Time
SUSE Linux Enterprise Module for Realtime
openEuler
Fedora
linux-image-virtual-lts-xenial (Ubuntu package)
linux-image-4.4.0-230-lowlatency (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-4.4.0-230-generic (Ubuntu package)
linux-image-4.4.0-1146-aws (Ubuntu package)
linux-image-4.4.0-1111-kvm (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-generic-lts-xenial (Ubuntu package)
linux-image-lowlatency-lts-xenial (Ubuntu package)
linux-image-4.4.0-1110-aws (Ubuntu package)
linux-image-virtual-hwe-16.04 (Ubuntu package)
linux-image-generic-hwe-16.04 (Ubuntu package)
linux-image-lowlatency-hwe-16.04 (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-4.15.0-177-generic-lpae (Ubuntu package)
linux-image-4.15.0-177-lowlatency (Ubuntu package)
linux-image-4.15.0-177-generic (Ubuntu package)
linux-image-dell300x (Ubuntu package)
linux-image-4.15.0-1042-dell300x (Ubuntu package)
linux-image-4.15.0-1093-oracle (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-4.15.0-1114-kvm (Ubuntu package)
linux-image-4.15.0-1122-gcp (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.15.0-1127-snapdragon (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1128-aws (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1138-azure (Ubuntu package)
kernel-devel
perf
perf-debuginfo
kernel-tools
bpftool-debuginfo
kernel-debugsource
bpftool
python2-perf
python3-perf-debuginfo
python3-perf
kernel-debuginfo
python2-perf-debuginfo
kernel-source
kernel-tools-debuginfo
kernel-tools-devel
kernel
kernel-debug-devel
kernel-debug
kernel-tools-libs-devel
kernel-tools-libs
kernel-modules-internal
kernel-modules-extra
kernel-modules
kernel-headers
python-perf
kernel-debug-modules-extra
kernel-debug-modules
kernel-debug-core
kernel-core
linux (Debian package)
kernel-syms-rt
kernel-devel-rt
kernel-source-rt
cluster-md-kmp-rt
kernel-rt-devel
cluster-md-kmp-rt-debuginfo
dlm-kmp-rt
dlm-kmp-rt-debuginfo
gfs2-kmp-rt
kernel-rt
kernel-rt_debug-devel-debuginfo
kernel-rt_debug-devel
kernel-rt_debug-debugsource
ocfs2-kmp-rt
ocfs2-kmp-rt-debuginfo
gfs2-kmp-rt-debuginfo
kernel-rt_debug-debuginfo
kernel-rt_debug
kernel-rt-devel-debuginfo
kernel-rt-debugsource
kernel-rt-debuginfo
linux-image-oem (Ubuntu package)
linux-image-oem-osp1 (Ubuntu package)
linux-image-5.4.0-110-lowlatency (Ubuntu package)
linux-image-5.4.0-110-generic-lpae (Ubuntu package)
linux-image-5.4.0-110-generic (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-ibm (Ubuntu package)
linux-image-ibm-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1021-ibm (Ubuntu package)
linux-image-5.4.0-1040-gkeop (Ubuntu package)
linux-image-gkeop-5.4 (Ubuntu package)
linux-image-gkeop (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1060-raspi (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-5.4.0-1063-kvm (Ubuntu package)
linux-image-oracle-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1071-gke (Ubuntu package)
linux-image-5.4.0-1071-oracle (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-gke-5.4 (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-aws-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1073-aws (Ubuntu package)
linux-image-5.4.0-1073-gcp (Ubuntu package)
linux-image-gcp-lts-20.04 (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-azure-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1078-azure (Ubuntu package)
linux-image-5.4.0-1078-azure-fde (Ubuntu package)
linux-image-azure-fde (Ubuntu package)
linux-image-5.13.0-41-generic (Ubuntu package)
linux-image-5.13.0-41-generic-64k (Ubuntu package)
linux-image-5.13.0-41-lowlatency (Ubuntu package)
linux-image-5.13.0-41-generic-lpae (Ubuntu package)
linux-image-generic-64k-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-5.13.0-1022-kvm (Ubuntu package)
linux-image-5.13.0-1023-aws (Ubuntu package)
linux-image-5.13.0-1023-azure (Ubuntu package)
linux-image-5.13.0-1025-gcp (Ubuntu package)
linux-image-5.13.0-1026-raspi-nolpae (Ubuntu package)
linux-image-5.13.0-1026-raspi (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-5.13.0-1028-oracle (Ubuntu package)
How to mitigate CVE-2022-25258
Google Android - addressed in versions 10 2022-06-05, 11 2022-06-05, 12L 2022-06-05, 12 2022-06-05
linux-image-virtual-lts-xenial (Ubuntu package) - update to 4.4.0230.264
linux-image-4.4.0-230-lowlatency (Ubuntu package) - update to 4.4.0230.264
linux-image-virtual (Ubuntu package) - addressed in versions 4.4.0230.264, 4.15.0.177.166, 5.4.0.110.114, 5.13.0.41.50
linux-image-generic (Ubuntu package) - addressed in versions 4.4.0230.264, 4.15.0.177.166, 5.4.0.110.114, 5.13.0.41.50
linux-image-aws (Ubuntu package) - addressed in versions 4.4.0230.264, 5.13.0.1023.24, 5.13.0.1023.25~20.04.16
linux-image-4.4.0-230-generic (Ubuntu package) - update to 4.4.0230.264
linux-image-4.4.0-1146-aws (Ubuntu package) - update to 4.4.0230.264
linux-image-4.4.0-1111-kvm (Ubuntu package) - update to 4.4.0230.264
linux-image-kvm (Ubuntu package) - addressed in versions 4.4.0230.264, 4.15.0.1114.110, 5.4.0.1063.62, 5.13.0.1022.22
linux-image-lowlatency (Ubuntu package) - addressed in versions 4.4.0230.264, 4.15.0.177.166, 5.4.0.110.114, 5.13.0.41.50
linux-image-generic-lts-xenial (Ubuntu package) - update to 4.4.0230.264
linux-image-lowlatency-lts-xenial (Ubuntu package) - update to 4.4.0230.264
linux-image-4.4.0-1110-aws (Ubuntu package) - update to 4.4.0230.264
linux-image-virtual-hwe-16.04 (Ubuntu package) - update to 4.15.0.177.166
linux-image-generic-hwe-16.04 (Ubuntu package) - update to 4.15.0.177.166
linux-image-lowlatency-hwe-16.04 (Ubuntu package) - update to 4.15.0.177.166
linux-image-generic-lpae (Ubuntu package) - addressed in versions 4.15.0.177.166, 5.4.0.110.114, 5.13.0.41.50
linux-image-4.15.0-177-generic-lpae (Ubuntu package) - update to 4.15.0-177.186
linux-image-4.15.0-177-lowlatency (Ubuntu package) - update to 4.15.0-177.186
linux-image-4.15.0-177-generic (Ubuntu package) - update to 4.15.0-177.186
linux-image-dell300x (Ubuntu package) - update to 4.15.0.1042.44
linux-image-4.15.0-1042-dell300x (Ubuntu package) - update to 4.15.0-1042.47
linux-image-4.15.0-1093-oracle (Ubuntu package) - update to 4.15.0-1093.102
linux-image-oracle-lts-18.04 (Ubuntu package) - update to 4.15.0.1093.103
linux-image-aws-hwe (Ubuntu package) - update to 4.15.0.1099.92
linux-image-4.15.0-1114-kvm (Ubuntu package) - update to 4.15.0-1114.117
linux-image-4.15.0-1122-gcp (Ubuntu package) - update to 4.15.0-1122.136
linux-image-gcp-lts-18.04 (Ubuntu package) - update to 4.15.0.1122.141
linux-image-snapdragon (Ubuntu package) - update to 4.15.0.1127.130
linux-image-4.15.0-1127-snapdragon (Ubuntu package) - update to 4.15.0-1127.136
linux-image-aws-lts-18.04 (Ubuntu package) - update to 4.15.0.1128.131
linux-image-4.15.0-1128-aws (Ubuntu package) - update to 4.15.0-1128.137
linux-image-azure-lts-18.04 (Ubuntu package) - update to 4.15.0.1138.111
linux-image-4.15.0-1138-azure (Ubuntu package) - update to 4.15.0-1138.151
kernel-devel - update to 4.19.90-2203.1.0.0139
perf - update to 4.19.90-2203.1.0.0139
perf-debuginfo - update to 4.19.90-2203.1.0.0139
kernel-tools - update to 4.19.90-2203.1.0.0139
bpftool-debuginfo - update to 4.19.90-2203.1.0.0139
kernel-debugsource - update to 4.19.90-2203.1.0.0139
bpftool - update to 4.19.90-2203.1.0.0139
python2-perf - update to 4.19.90-2203.1.0.0139
python3-perf-debuginfo - update to 4.19.90-2203.1.0.0139
python3-perf - update to 4.19.90-2203.1.0.0139
kernel-debuginfo - update to 4.19.90-2203.1.0.0139
python2-perf-debuginfo - update to 4.19.90-2203.1.0.0139
kernel-source - update to 4.19.90-2203.1.0.0139
kernel-tools-debuginfo - update to 4.19.90-2203.1.0.0139
kernel-tools-devel - update to 4.19.90-2203.1.0.0139
kernel - update to 4.19.90-2203.1.0.0139
kernel-devel - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-debug-devel - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-debug - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel - addressed in versions 4.19.91-26.6, 4.19.91-27
bpftool - addressed in versions 4.19.91-26.6, 4.19.91-27
python3-perf - addressed in versions 4.19.91-26.6, 4.19.91-27
perf - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-tools-libs-devel - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-tools-libs - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-tools - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-modules-internal - update to 4.19.91-26.6
kernel-modules-extra - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-modules - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-headers - addressed in versions 4.19.91-26.6, 4.19.91-27
python-perf - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-debug-modules-extra - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-debug-modules - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-debug-core - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-core - addressed in versions 4.19.91-26.6, 4.19.91-27
linux (Debian package) - addressed in versions 4.19.232-1, 5.10.92-2
kernel-syms-rt - addressed in versions 5.3.18-150200.79.1, 5.3.18-150300.82.1
kernel-devel-rt - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-source-rt - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
cluster-md-kmp-rt - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt-devel - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
cluster-md-kmp-rt-debuginfo - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
dlm-kmp-rt - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
dlm-kmp-rt-debuginfo - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
gfs2-kmp-rt - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt_debug-devel-debuginfo - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt_debug-devel - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt_debug-debugsource - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
ocfs2-kmp-rt - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
ocfs2-kmp-rt-debuginfo - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
gfs2-kmp-rt-debuginfo - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt_debug-debuginfo - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt_debug - update to 5.3.18-150200.79.2
kernel-rt-devel-debuginfo - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt-debugsource - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt-debuginfo - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
linux-image-oem (Ubuntu package) - addressed in versions 5.4.0.110.114, 5.4.0.110.124~18.04.95
linux-image-oem-osp1 (Ubuntu package) - addressed in versions 5.4.0.110.114, 5.4.0.110.124~18.04.95
linux-image-5.4.0-110-lowlatency (Ubuntu package) - addressed in versions 5.4.0-110.124, 5.4.0-110.124~18.04.1
linux-image-5.4.0-110-generic-lpae (Ubuntu package) - addressed in versions 5.4.0-110.124, 5.4.0-110.124~18.04.1
linux-image-5.4.0-110-generic (Ubuntu package) - addressed in versions 5.4.0-110.124, 5.4.0-110.124~18.04.1
linux-image-generic-hwe-18.04 (Ubuntu package) - update to 5.4.0.110.124~18.04.95
linux-image-snapdragon-hwe-18.04 (Ubuntu package) - update to 5.4.0.110.124~18.04.95
linux-image-generic-lpae-hwe-18.04 (Ubuntu package) - update to 5.4.0.110.124~18.04.95
linux-image-lowlatency-hwe-18.04 (Ubuntu package) - update to 5.4.0.110.124~18.04.95
linux-image-virtual-hwe-18.04 (Ubuntu package) - update to 5.4.0.110.124~18.04.95
linux-image-ibm (Ubuntu package) - addressed in versions 5.4.0.1021.21, 5.4.0.1021.38
linux-image-ibm-lts-20.04 (Ubuntu package) - update to 5.4.0.1021.21
linux-image-5.4.0-1021-ibm (Ubuntu package) - addressed in versions 5.4.0-1021.23, 5.4.0-1021.23~18.04.1
linux-image-5.4.0-1040-gkeop (Ubuntu package) - addressed in versions 5.4.0-1040.41, 5.4.0-1040.41~18.04.1
linux-image-gkeop-5.4 (Ubuntu package) - addressed in versions 5.4.0.1040.41~18.04.40, 5.4.0.1040.43
linux-image-gkeop (Ubuntu package) - update to 5.4.0.1040.43
linux-image-raspi-hwe-18.04 (Ubuntu package) - update to 5.4.0.1060.61
linux-image-5.4.0-1060-raspi (Ubuntu package) - addressed in versions 5.4.0-1060.68, 5.4.0-1060.68~18.04.1
linux-image-raspi (Ubuntu package) - addressed in versions 5.4.0.1060.94, 5.13.0.1026.31
linux-image-raspi2 (Ubuntu package) - update to 5.4.0.1060.94
linux-image-5.4.0-1063-kvm (Ubuntu package) - update to 5.4.0-1063.66
linux-image-oracle-lts-20.04 (Ubuntu package) - update to 5.4.0.1071.71
linux-image-5.4.0-1071-gke (Ubuntu package) - update to 5.4.0-1071.76
linux-image-5.4.0-1071-oracle (Ubuntu package) - addressed in versions 5.4.0-1071.77, 5.4.0-1071.77~18.04.1
linux-image-oracle (Ubuntu package) - addressed in versions 5.4.0.1071.77~18.04.50, 5.13.0.1028.28
linux-image-gke (Ubuntu package) - addressed in versions 5.4.0.1071.80, 5.13.0.1024.22, 5.13.0.1025.23
linux-image-gke-5.4 (Ubuntu package) - update to 5.4.0.1071.80
linux-image-gcp (Ubuntu package) - addressed in versions 5.4.0.1073.57, 5.13.0.1025.23, 5.13.0.1025.30~20.04.1
linux-image-aws-lts-20.04 (Ubuntu package) - update to 5.4.0.1073.75
linux-image-5.4.0-1073-aws (Ubuntu package) - update to 5.4.0-1073.78
linux-image-5.4.0-1073-gcp (Ubuntu package) - addressed in versions 5.4.0-1073.78, 5.4.0-1073.78~18.04.1
linux-image-gcp-lts-20.04 (Ubuntu package) - update to 5.4.0.1073.81
linux-image-azure (Ubuntu package) - addressed in versions 5.4.0.1078.57, 5.13.0.1023.23, 5.13.0.1023.27~20.04.12
linux-image-azure-lts-20.04 (Ubuntu package) - update to 5.4.0.1078.76
linux-image-5.4.0-1078-azure (Ubuntu package) - addressed in versions 5.4.0-1078.81, 5.4.0-1078.81~18.04.1
linux-image-5.4.0-1078-azure-fde (Ubuntu package) - update to 5.4.0-1078.81+cvm1.1
linux-image-azure-fde (Ubuntu package) - update to 5.4.0.1078.81+cvm1.22
linux-image-5.13.0-41-generic (Ubuntu package) - addressed in versions 5.13.0-41.46, 5.13.0-41.46~20.04.1
linux-image-5.13.0-41-generic-64k (Ubuntu package) - addressed in versions 5.13.0-41.46, 5.13.0-41.46~20.04.1
linux-image-5.13.0-41-lowlatency (Ubuntu package) - addressed in versions 5.13.0-41.46, 5.13.0-41.46~20.04.1
linux-image-5.13.0-41-generic-lpae (Ubuntu package) - addressed in versions 5.13.0-41.46, 5.13.0-41.46~20.04.1
linux-image-generic-64k-hwe-20.04 (Ubuntu package) - update to 5.13.0.41.46~20.04.26
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.13.0.41.46~20.04.26
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.13.0.41.46~20.04.26
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.13.0.41.46~20.04.26
linux-image-lowlatency-hwe-20.04 (Ubuntu package) - update to 5.13.0.41.46~20.04.26
linux-image-oem-20.04 (Ubuntu package) - update to 5.13.0.41.50
linux-image-generic-64k (Ubuntu package) - update to 5.13.0.41.50
linux-image-5.13.0-1022-kvm (Ubuntu package) - update to 5.13.0-1022.23
linux-image-5.13.0-1023-aws (Ubuntu package) - addressed in versions 5.13.0-1023.25, 5.13.0-1023.25~20.04.1
linux-image-5.13.0-1023-azure (Ubuntu package) - addressed in versions 5.13.0-1023.27, 5.13.0-1023.27~20.04.1
linux-image-5.13.0-1025-gcp (Ubuntu package) - addressed in versions 5.13.0-1025.30, 5.13.0-1025.30~20.04.1
linux-image-5.13.0-1026-raspi-nolpae (Ubuntu package) - update to 5.13.0-1026.28
linux-image-5.13.0-1026-raspi (Ubuntu package) - update to 5.13.0-1026.28
linux-image-raspi-nolpae (Ubuntu package) - update to 5.13.0.1026.31
linux-image-5.13.0-1028-oracle (Ubuntu package) - update to 5.13.0-1028.33
kernel - update to 5.16.10-200.fc35
External References
- https://github.com/torvalds/linux/commit/75e5b4849b81e19e9efe1654b30d7f3151c33c2c
- https://github.com/szymonh/d-os-descriptor
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TCW2KZYJ2H6BKZE3CVLHRIXYDGNYYC5P/
- https://www.debian.org/security/2022/dsa-5096
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
- https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html
- https://www.debian.org/security/2022/dsa-5092
Related Security Bulletins
- Multiple vulnerabilities in Linux kernel
- Slackware Linux update for Slackware 15.0 kernel
- Debian update for linux 4.19
- Ubuntu update for linux
- Ubuntu update for linux
- Ubuntu update for linux
- Multiple vulnerabilities in Google Android
- Ubuntu update for linux
- Debian update for linux
- Debian update for linux
- SUSE update for the Linux Kernel
- SUSE update for the Linux Kernel
- openEuler update for kernel
- Fedora 35 update for kernel
- Anolis OS update for kernel
- Anolis OS update for kernel(ANCK)4.19
- Anolis OS update for kernel(ANCK)4.19
- Anolis OS update for kernel(ANCK)4.19