NULL pointer dereference in Linux kernel - CVE-2022-25258

 

NULL pointer dereference in Linux kernel - CVE-2022-25258

Published: March 13, 2022


Vulnerability identifier: #VU61270
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-25258
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error drivers/usb/gadget/composite.c in the Linux kernel. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). A local user can run a specially crafted program to trigger memory corruption and perform a denial of service (DoS) attack.


Affected software

Linux kernel
Debian Linux
SUSE Linux Enterprise Micro
Anolis OS
Google Android
Ubuntu
Slackware Linux
SUSE Linux Enterprise Real Time
SUSE Linux Enterprise Module for Realtime
openEuler
Fedora
linux-image-virtual-lts-xenial (Ubuntu package)
linux-image-4.4.0-230-lowlatency (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-4.4.0-230-generic (Ubuntu package)
linux-image-4.4.0-1146-aws (Ubuntu package)
linux-image-4.4.0-1111-kvm (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-generic-lts-xenial (Ubuntu package)
linux-image-lowlatency-lts-xenial (Ubuntu package)
linux-image-4.4.0-1110-aws (Ubuntu package)
linux-image-virtual-hwe-16.04 (Ubuntu package)
linux-image-generic-hwe-16.04 (Ubuntu package)
linux-image-lowlatency-hwe-16.04 (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-4.15.0-177-generic-lpae (Ubuntu package)
linux-image-4.15.0-177-lowlatency (Ubuntu package)
linux-image-4.15.0-177-generic (Ubuntu package)
linux-image-dell300x (Ubuntu package)
linux-image-4.15.0-1042-dell300x (Ubuntu package)
linux-image-4.15.0-1093-oracle (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-4.15.0-1114-kvm (Ubuntu package)
linux-image-4.15.0-1122-gcp (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.15.0-1127-snapdragon (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1128-aws (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1138-azure (Ubuntu package)
kernel-devel
perf
perf-debuginfo
kernel-tools
bpftool-debuginfo
kernel-debugsource
bpftool
python2-perf
python3-perf-debuginfo
python3-perf
kernel-debuginfo
python2-perf-debuginfo
kernel-source
kernel-tools-debuginfo
kernel-tools-devel
kernel
kernel-debug-devel
kernel-debug
kernel-tools-libs-devel
kernel-tools-libs
kernel-modules-internal
kernel-modules-extra
kernel-modules
kernel-headers
python-perf
kernel-debug-modules-extra
kernel-debug-modules
kernel-debug-core
kernel-core
linux (Debian package)
kernel-syms-rt
kernel-devel-rt
kernel-source-rt
cluster-md-kmp-rt
kernel-rt-devel
cluster-md-kmp-rt-debuginfo
dlm-kmp-rt
dlm-kmp-rt-debuginfo
gfs2-kmp-rt
kernel-rt
kernel-rt_debug-devel-debuginfo
kernel-rt_debug-devel
kernel-rt_debug-debugsource
ocfs2-kmp-rt
ocfs2-kmp-rt-debuginfo
gfs2-kmp-rt-debuginfo
kernel-rt_debug-debuginfo
kernel-rt_debug
kernel-rt-devel-debuginfo
kernel-rt-debugsource
kernel-rt-debuginfo
linux-image-oem (Ubuntu package)
linux-image-oem-osp1 (Ubuntu package)
linux-image-5.4.0-110-lowlatency (Ubuntu package)
linux-image-5.4.0-110-generic-lpae (Ubuntu package)
linux-image-5.4.0-110-generic (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-ibm (Ubuntu package)
linux-image-ibm-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1021-ibm (Ubuntu package)
linux-image-5.4.0-1040-gkeop (Ubuntu package)
linux-image-gkeop-5.4 (Ubuntu package)
linux-image-gkeop (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1060-raspi (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-5.4.0-1063-kvm (Ubuntu package)
linux-image-oracle-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1071-gke (Ubuntu package)
linux-image-5.4.0-1071-oracle (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-gke-5.4 (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-aws-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1073-aws (Ubuntu package)
linux-image-5.4.0-1073-gcp (Ubuntu package)
linux-image-gcp-lts-20.04 (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-azure-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1078-azure (Ubuntu package)
linux-image-5.4.0-1078-azure-fde (Ubuntu package)
linux-image-azure-fde (Ubuntu package)
linux-image-5.13.0-41-generic (Ubuntu package)
linux-image-5.13.0-41-generic-64k (Ubuntu package)
linux-image-5.13.0-41-lowlatency (Ubuntu package)
linux-image-5.13.0-41-generic-lpae (Ubuntu package)
linux-image-generic-64k-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-5.13.0-1022-kvm (Ubuntu package)
linux-image-5.13.0-1023-aws (Ubuntu package)
linux-image-5.13.0-1023-azure (Ubuntu package)
linux-image-5.13.0-1025-gcp (Ubuntu package)
linux-image-5.13.0-1026-raspi-nolpae (Ubuntu package)
linux-image-5.13.0-1026-raspi (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-5.13.0-1028-oracle (Ubuntu package)

How to mitigate CVE-2022-25258

Install updates from vendor's website.

Linux kernel - update to 5.16.10
Google Android - addressed in versions 10 2022-06-05, 11 2022-06-05, 12L 2022-06-05, 12 2022-06-05
linux-image-virtual-lts-xenial (Ubuntu package) - update to 4.4.0230.264
linux-image-4.4.0-230-lowlatency (Ubuntu package) - update to 4.4.0230.264
linux-image-virtual (Ubuntu package) - addressed in versions 4.4.0230.264, 4.15.0.177.166, 5.4.0.110.114, 5.13.0.41.50
linux-image-generic (Ubuntu package) - addressed in versions 4.4.0230.264, 4.15.0.177.166, 5.4.0.110.114, 5.13.0.41.50
linux-image-aws (Ubuntu package) - addressed in versions 4.4.0230.264, 5.13.0.1023.24, 5.13.0.1023.25~20.04.16
linux-image-4.4.0-230-generic (Ubuntu package) - update to 4.4.0230.264
linux-image-4.4.0-1146-aws (Ubuntu package) - update to 4.4.0230.264
linux-image-4.4.0-1111-kvm (Ubuntu package) - update to 4.4.0230.264
linux-image-kvm (Ubuntu package) - addressed in versions 4.4.0230.264, 4.15.0.1114.110, 5.4.0.1063.62, 5.13.0.1022.22
linux-image-lowlatency (Ubuntu package) - addressed in versions 4.4.0230.264, 4.15.0.177.166, 5.4.0.110.114, 5.13.0.41.50
linux-image-generic-lts-xenial (Ubuntu package) - update to 4.4.0230.264
linux-image-lowlatency-lts-xenial (Ubuntu package) - update to 4.4.0230.264
linux-image-4.4.0-1110-aws (Ubuntu package) - update to 4.4.0230.264
linux-image-virtual-hwe-16.04 (Ubuntu package) - update to 4.15.0.177.166
linux-image-generic-hwe-16.04 (Ubuntu package) - update to 4.15.0.177.166
linux-image-lowlatency-hwe-16.04 (Ubuntu package) - update to 4.15.0.177.166
linux-image-generic-lpae (Ubuntu package) - addressed in versions 4.15.0.177.166, 5.4.0.110.114, 5.13.0.41.50
linux-image-4.15.0-177-generic-lpae (Ubuntu package) - update to 4.15.0-177.186
linux-image-4.15.0-177-lowlatency (Ubuntu package) - update to 4.15.0-177.186
linux-image-4.15.0-177-generic (Ubuntu package) - update to 4.15.0-177.186
linux-image-dell300x (Ubuntu package) - update to 4.15.0.1042.44
linux-image-4.15.0-1042-dell300x (Ubuntu package) - update to 4.15.0-1042.47
linux-image-4.15.0-1093-oracle (Ubuntu package) - update to 4.15.0-1093.102
linux-image-oracle-lts-18.04 (Ubuntu package) - update to 4.15.0.1093.103
linux-image-aws-hwe (Ubuntu package) - update to 4.15.0.1099.92
linux-image-4.15.0-1114-kvm (Ubuntu package) - update to 4.15.0-1114.117
linux-image-4.15.0-1122-gcp (Ubuntu package) - update to 4.15.0-1122.136
linux-image-gcp-lts-18.04 (Ubuntu package) - update to 4.15.0.1122.141
linux-image-snapdragon (Ubuntu package) - update to 4.15.0.1127.130
linux-image-4.15.0-1127-snapdragon (Ubuntu package) - update to 4.15.0-1127.136
linux-image-aws-lts-18.04 (Ubuntu package) - update to 4.15.0.1128.131
linux-image-4.15.0-1128-aws (Ubuntu package) - update to 4.15.0-1128.137
linux-image-azure-lts-18.04 (Ubuntu package) - update to 4.15.0.1138.111
linux-image-4.15.0-1138-azure (Ubuntu package) - update to 4.15.0-1138.151
kernel-devel - update to 4.19.90-2203.1.0.0139
perf - update to 4.19.90-2203.1.0.0139
perf-debuginfo - update to 4.19.90-2203.1.0.0139
kernel-tools - update to 4.19.90-2203.1.0.0139
bpftool-debuginfo - update to 4.19.90-2203.1.0.0139
kernel-debugsource - update to 4.19.90-2203.1.0.0139
bpftool - update to 4.19.90-2203.1.0.0139
python2-perf - update to 4.19.90-2203.1.0.0139
python3-perf-debuginfo - update to 4.19.90-2203.1.0.0139
python3-perf - update to 4.19.90-2203.1.0.0139
kernel-debuginfo - update to 4.19.90-2203.1.0.0139
python2-perf-debuginfo - update to 4.19.90-2203.1.0.0139
kernel-source - update to 4.19.90-2203.1.0.0139
kernel-tools-debuginfo - update to 4.19.90-2203.1.0.0139
kernel-tools-devel - update to 4.19.90-2203.1.0.0139
kernel - update to 4.19.90-2203.1.0.0139
kernel-devel - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-debug-devel - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-debug - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel - addressed in versions 4.19.91-26.6, 4.19.91-27
bpftool - addressed in versions 4.19.91-26.6, 4.19.91-27
python3-perf - addressed in versions 4.19.91-26.6, 4.19.91-27
perf - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-tools-libs-devel - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-tools-libs - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-tools - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-modules-internal - update to 4.19.91-26.6
kernel-modules-extra - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-modules - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-headers - addressed in versions 4.19.91-26.6, 4.19.91-27
python-perf - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-debug-modules-extra - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-debug-modules - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-debug-core - addressed in versions 4.19.91-26.6, 4.19.91-27
kernel-core - addressed in versions 4.19.91-26.6, 4.19.91-27
linux (Debian package) - addressed in versions 4.19.232-1, 5.10.92-2
kernel-syms-rt - addressed in versions 5.3.18-150200.79.1, 5.3.18-150300.82.1
kernel-devel-rt - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-source-rt - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
cluster-md-kmp-rt - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt-devel - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
cluster-md-kmp-rt-debuginfo - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
dlm-kmp-rt - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
dlm-kmp-rt-debuginfo - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
gfs2-kmp-rt - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt_debug-devel-debuginfo - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt_debug-devel - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt_debug-debugsource - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
ocfs2-kmp-rt - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
ocfs2-kmp-rt-debuginfo - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
gfs2-kmp-rt-debuginfo - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt_debug-debuginfo - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt_debug - update to 5.3.18-150200.79.2
kernel-rt-devel-debuginfo - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt-debugsource - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
kernel-rt-debuginfo - addressed in versions 5.3.18-150200.79.2, 5.3.18-150300.82.1
linux-image-oem (Ubuntu package) - addressed in versions 5.4.0.110.114, 5.4.0.110.124~18.04.95
linux-image-oem-osp1 (Ubuntu package) - addressed in versions 5.4.0.110.114, 5.4.0.110.124~18.04.95
linux-image-5.4.0-110-lowlatency (Ubuntu package) - addressed in versions 5.4.0-110.124, 5.4.0-110.124~18.04.1
linux-image-5.4.0-110-generic-lpae (Ubuntu package) - addressed in versions 5.4.0-110.124, 5.4.0-110.124~18.04.1
linux-image-5.4.0-110-generic (Ubuntu package) - addressed in versions 5.4.0-110.124, 5.4.0-110.124~18.04.1
linux-image-generic-hwe-18.04 (Ubuntu package) - update to 5.4.0.110.124~18.04.95
linux-image-snapdragon-hwe-18.04 (Ubuntu package) - update to 5.4.0.110.124~18.04.95
linux-image-generic-lpae-hwe-18.04 (Ubuntu package) - update to 5.4.0.110.124~18.04.95
linux-image-lowlatency-hwe-18.04 (Ubuntu package) - update to 5.4.0.110.124~18.04.95
linux-image-virtual-hwe-18.04 (Ubuntu package) - update to 5.4.0.110.124~18.04.95
linux-image-ibm (Ubuntu package) - addressed in versions 5.4.0.1021.21, 5.4.0.1021.38
linux-image-ibm-lts-20.04 (Ubuntu package) - update to 5.4.0.1021.21
linux-image-5.4.0-1021-ibm (Ubuntu package) - addressed in versions 5.4.0-1021.23, 5.4.0-1021.23~18.04.1
linux-image-5.4.0-1040-gkeop (Ubuntu package) - addressed in versions 5.4.0-1040.41, 5.4.0-1040.41~18.04.1
linux-image-gkeop-5.4 (Ubuntu package) - addressed in versions 5.4.0.1040.41~18.04.40, 5.4.0.1040.43
linux-image-gkeop (Ubuntu package) - update to 5.4.0.1040.43
linux-image-raspi-hwe-18.04 (Ubuntu package) - update to 5.4.0.1060.61
linux-image-5.4.0-1060-raspi (Ubuntu package) - addressed in versions 5.4.0-1060.68, 5.4.0-1060.68~18.04.1
linux-image-raspi (Ubuntu package) - addressed in versions 5.4.0.1060.94, 5.13.0.1026.31
linux-image-raspi2 (Ubuntu package) - update to 5.4.0.1060.94
linux-image-5.4.0-1063-kvm (Ubuntu package) - update to 5.4.0-1063.66
linux-image-oracle-lts-20.04 (Ubuntu package) - update to 5.4.0.1071.71
linux-image-5.4.0-1071-gke (Ubuntu package) - update to 5.4.0-1071.76
linux-image-5.4.0-1071-oracle (Ubuntu package) - addressed in versions 5.4.0-1071.77, 5.4.0-1071.77~18.04.1
linux-image-oracle (Ubuntu package) - addressed in versions 5.4.0.1071.77~18.04.50, 5.13.0.1028.28
linux-image-gke (Ubuntu package) - addressed in versions 5.4.0.1071.80, 5.13.0.1024.22, 5.13.0.1025.23
linux-image-gke-5.4 (Ubuntu package) - update to 5.4.0.1071.80
linux-image-gcp (Ubuntu package) - addressed in versions 5.4.0.1073.57, 5.13.0.1025.23, 5.13.0.1025.30~20.04.1
linux-image-aws-lts-20.04 (Ubuntu package) - update to 5.4.0.1073.75
linux-image-5.4.0-1073-aws (Ubuntu package) - update to 5.4.0-1073.78
linux-image-5.4.0-1073-gcp (Ubuntu package) - addressed in versions 5.4.0-1073.78, 5.4.0-1073.78~18.04.1
linux-image-gcp-lts-20.04 (Ubuntu package) - update to 5.4.0.1073.81
linux-image-azure (Ubuntu package) - addressed in versions 5.4.0.1078.57, 5.13.0.1023.23, 5.13.0.1023.27~20.04.12
linux-image-azure-lts-20.04 (Ubuntu package) - update to 5.4.0.1078.76
linux-image-5.4.0-1078-azure (Ubuntu package) - addressed in versions 5.4.0-1078.81, 5.4.0-1078.81~18.04.1
linux-image-5.4.0-1078-azure-fde (Ubuntu package) - update to 5.4.0-1078.81+cvm1.1
linux-image-azure-fde (Ubuntu package) - update to 5.4.0.1078.81+cvm1.22
linux-image-5.13.0-41-generic (Ubuntu package) - addressed in versions 5.13.0-41.46, 5.13.0-41.46~20.04.1
linux-image-5.13.0-41-generic-64k (Ubuntu package) - addressed in versions 5.13.0-41.46, 5.13.0-41.46~20.04.1
linux-image-5.13.0-41-lowlatency (Ubuntu package) - addressed in versions 5.13.0-41.46, 5.13.0-41.46~20.04.1
linux-image-5.13.0-41-generic-lpae (Ubuntu package) - addressed in versions 5.13.0-41.46, 5.13.0-41.46~20.04.1
linux-image-generic-64k-hwe-20.04 (Ubuntu package) - update to 5.13.0.41.46~20.04.26
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.13.0.41.46~20.04.26
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.13.0.41.46~20.04.26
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.13.0.41.46~20.04.26
linux-image-lowlatency-hwe-20.04 (Ubuntu package) - update to 5.13.0.41.46~20.04.26
linux-image-oem-20.04 (Ubuntu package) - update to 5.13.0.41.50
linux-image-generic-64k (Ubuntu package) - update to 5.13.0.41.50
linux-image-5.13.0-1022-kvm (Ubuntu package) - update to 5.13.0-1022.23
linux-image-5.13.0-1023-aws (Ubuntu package) - addressed in versions 5.13.0-1023.25, 5.13.0-1023.25~20.04.1
linux-image-5.13.0-1023-azure (Ubuntu package) - addressed in versions 5.13.0-1023.27, 5.13.0-1023.27~20.04.1
linux-image-5.13.0-1025-gcp (Ubuntu package) - addressed in versions 5.13.0-1025.30, 5.13.0-1025.30~20.04.1
linux-image-5.13.0-1026-raspi-nolpae (Ubuntu package) - update to 5.13.0-1026.28
linux-image-5.13.0-1026-raspi (Ubuntu package) - update to 5.13.0-1026.28
linux-image-raspi-nolpae (Ubuntu package) - update to 5.13.0.1026.31
linux-image-5.13.0-1028-oracle (Ubuntu package) - update to 5.13.0-1028.33
kernel - update to 5.16.10-200.fc35

External References

Related Security Bulletins