CVE-2022-50635
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-09
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.0.0-rc3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a null pointer dereference in the Linux kernel's powerpc/kprobes subsystem, specifically in the arch_prepare_kprobe() function. It occurs when the kernel attempts to read an instruction pointer from a kprobe that is based on ftrace, which does not generate a valid instruction pointer, resulting in a null pointer reference and a kernel crash (oops). The issue arises because the code does not properly check if the previous kprobe is ftrace-based before accessing its instruction pointer, leading to a kernel NULL pointer dereference on read.
How can this vulnerability impact me? :
This vulnerability can cause a kernel crash (NULL pointer dereference) when using kprobes on powerpc architectures, potentially leading to system instability or denial of service. An attacker with the ability to register kprobes could exploit this to crash the kernel, disrupting normal system operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing kernel logs for null pointer dereference errors related to kprobes, specifically messages like 'Kernel NULL pointer dereference on read at 0x00000000' and 'Kernel attempted to read user page (0) - exploit attempt?'. Commands to reproduce or detect the issue include writing probe commands to the kprobe_events file, for example: echo 'p cmdline_proc_show' > kprobe_events echo 'p cmdline_proc_show+16' >> kprobe_events Monitoring dmesg or kernel logs for oops or BUG messages related to kprobes can help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves applying the patch that fixes the null pointer reference in arch_prepare_kprobe() by checking if the previous kprobe is ftrace-based before accessing its instruction pointer. Until the patch is applied, avoid using ftrace-based kprobes that could trigger this null pointer dereference. Monitoring kernel logs for related errors and restricting untrusted users from registering kprobes can also help mitigate risk.