#VU99120 Infinite loop in Linux kernel - CVE-2022-49019

Vulnerability identifier: #VU99120

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49019

CWE-ID: CWE-835

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the nixge_hw_dma_bd_release() function in drivers/net/ethernet/ni/nixge.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/910c0264b64ef2dad8887714a7c56c93e39a0ed3
http://git.kernel.org/stable/c/45752af0247589e6d3dede577415bfe117b4392c
http://git.kernel.org/stable/c/9c584d6d9cfb935dce8fc81a4c26debac0a3049b
http://git.kernel.org/stable/c/80e82f7b440b65cf131dce10f487dc73a7046e6b
http://git.kernel.org/stable/c/9256db4e45e8b497b0e993cc3ed4ad08eb2389b6

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.