vulnerability
Ubuntu: (CVE-2022-49824): linux vulnerability
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:L/AC:L/Au:S/C:N/I:N/A:C) | May 1, 2025 | May 8, 2025 | Jun 12, 2025 |
Description
In the Linux kernel, the following vulnerability has been resolved:
ata: libata-transport: fix error handling in ata_tlink_add()
In ata_tlink_add(), the return value of transport_add_device() is
not checked. As a result, it causes null-ptr-deref while removing
the module, because transport_remove_device() is called to remove
the device that was not added.
Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0
CPU: 33 PID: 13850 Comm: rmmod Kdump: loaded Tainted: G W 6.1.0-rc3+ #12
pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : device_del+0x48/0x39c
lr : device_del+0x44/0x39c
Call trace:
device_del+0x48/0x39c
attribute_container_class_device_del+0x28/0x40
transport_remove_classdev+0x60/0x7c
attribute_container_device_trigger+0x118/0x120
transport_remove_device+0x20/0x30
ata_tlink_delete+0x88/0xb0 [libata]
ata_tport_delete+0x2c/0x60 [libata]
ata_port_detach+0x148/0x1b0 [libata]
ata_pci_remove_one+0x50/0x80 [libata]
ahci_remove_one+0x4c/0x8c [ahci]
Fix this by checking and handling return value of transport_add_device()
in ata_tlink_add().
Solution(s)
References
- CVE-2022-49824
- https://attackerkb.com/topics/CVE-2022-49824
- URL-https://git.kernel.org/linus/cf0816f6322c5c37ee52655f928e91ecf32da103
- URL-https://git.kernel.org/stable/c/67b219314628b90b3a314528e177335b0cd5c70b
- URL-https://git.kernel.org/stable/c/7377a14598f6b04446c54bc4a50cd249470d6c6f
- URL-https://git.kernel.org/stable/c/cf0816f6322c5c37ee52655f928e91ecf32da103
- URL-https://git.kernel.org/stable/c/d5234480ca822bdcf03fe4d6a590ddcb854558f7
- URL-https://www.cve.org/CVERecord?id=CVE-2022-49824
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.