CVE-2022-50047
BaseFortify
Publication date: 2025-06-18
Last updated on: 2025-11-13
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | 6.0 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's mv88e6060 driver for network switches. If a port is neither a CPU port nor a user port, a pointer named 'cpu_dp' is null. The code attempts to dereference this null pointer in the function mv88e6060_setup_port(), causing the kernel to crash due to a NULL pointer dereference.
How can this vulnerability impact me? :
The impact of this vulnerability is a kernel crash, which can lead to a denial of service on the affected system. This crash occurs when the driver attempts to set up an unused port incorrectly, potentially causing system instability or downtime.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking your system logs for kernel crash messages related to mv88e6060_setup_port or NULL pointer dereferences. Specifically, look for messages similar to: '[ 9.575872] Unable to handle kernel NULL pointer dereference at virtual address 00000014' and stack traces involving mv88e6060_setup from dsa_register_switch. Using commands like 'dmesg | grep mv88e6060' or 'journalctl -k | grep mv88e6060' can help identify if the crash has occurred.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this vulnerability is fixed. Since the issue is a kernel crash caused by dereferencing a null pointer in mv88e6060_setup_port, applying the vendor's patch or upgrading to a kernel version that includes the fix will prevent the crash. Until then, avoid using configurations that involve unused ports on the mv88e6060 switch driver.