CVE-2022-1205 in Linux
Summary
by MITRE • 08/31/2022
A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/18/2025
The vulnerability identified as CVE-2022-1205 represents a critical NULL pointer dereference flaw within the Linux kernel's Amateur Radio AX.25 protocol implementation. This protocol serves as a packet switching network protocol used primarily in amateur radio communications, enabling data transmission over radio frequencies for hobbyist and emergency communication purposes. The flaw exists in the kernel's handling of user connections to the AX.25 protocol subsystem, where improper validation of pointer references leads to system instability. The issue manifests when a local user attempts to establish a connection through the AX.25 protocol interface, triggering the NULL pointer dereference condition that results in immediate system crash.
This vulnerability operates at the kernel level within the Linux networking stack, specifically affecting the Amateur Radio AX.25 subsystem that implements the AX.25 protocol for amateur radio communications. The technical flaw occurs during the connection establishment phase when the kernel fails to properly validate pointer references before dereferencing them. According to CWE classification, this represents a CWE-476 NULL Pointer Dereference vulnerability, where the system attempts to access memory through a null pointer reference. The flaw does not require network access or remote exploitation, making it particularly concerning as it can be triggered by any local user with access to the system, including unprivileged accounts.
The operational impact of CVE-2022-1205 extends beyond simple system crashes to potentially disrupt critical amateur radio communication services and emergency response systems that rely on AX.25 protocol implementations. Local users can exploit this vulnerability to cause denial of service conditions, effectively rendering the affected system unusable until manual reboot occurs. This vulnerability affects Linux kernel versions that include the AX.25 protocol implementation, which may be present in various server configurations, embedded systems, and amateur radio equipment that utilizes Linux-based operating systems. The attack surface is particularly relevant in environments where amateur radio operators maintain systems that might be accessible to local users or where the protocol is used for critical communication infrastructure.
Mitigation strategies for CVE-2022-1205 focus primarily on kernel updates and system hardening measures. System administrators should immediately apply the latest kernel security patches provided by their distribution vendors to address the vulnerability. Additionally, implementing proper access controls and privilege restrictions can limit local user access to the AX.25 protocol interface, reducing exploitation risk. The vulnerability aligns with ATT&CK technique T1499.004 for network denial of service, as it creates system instability through kernel-level memory access violations. Organizations should also consider disabling the AX.25 protocol if it is not actively required, using kernel module blacklisting or configuration options to prevent loading of the vulnerable subsystem. Security monitoring should include detection of abnormal system crashes or kernel oops messages that may indicate exploitation attempts. The patching process should be prioritized in environments where amateur radio systems are critical, as these systems may be used in emergency response scenarios where availability is paramount.