Linux Kernel up to 5.15.46/5.17.14/5.18.3 8250_aspeed_vuart platform_get_resource null pointer dereference

Summaryinfo

A vulnerability labeled as critical has been found in Linux Kernel up to 5.15.46/5.17.14/5.18.3. Affected by this vulnerability is the function platform_get_resource of the component 8250_aspeed_vuart. Such manipulation leads to null pointer dereference. This vulnerability is listed as CVE-2022-49392. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.15.46/5.17.14/5.18.3 and classified as critical. Affected by this issue is the function platform_get_resource of the component 8250_aspeed_vuart. The manipulation with an unknown input leads to a null pointer dereference vulnerability. Using CWE to declare the problem leads to CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. Impacted is availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: serial: 8250_aspeed_vuart: Fix potential NULL dereference in aspeed_vuart_probe platform_get_resource() may fail and return NULL, so we should better check it's return value to avoid a NULL pointer dereference.

The advisory is available at git.kernel.org. This vulnerability is handled as CVE-2022-49392 since 02/26/2025. Technical details are known, but there is no available exploit.

Upgrading to version 5.15.47, 5.17.15 or 5.18.4 eliminates this vulnerability. Applying the patch 923d34ce069e8e51a4d003caa6b66a8cd6ecd0ed/90a6b6fc52bfdcfe9698454bf5bea26112abbcd1/d5f1275f101e0e8a172d300d897f5a12e87e3485/0e0fd55719fa081de6f9e5d9e6cef48efb04d34a is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 5.15.15
• 5.15.16
• 5.15.17
• 5.15.18
• 5.15.19
• 5.15.20
• 5.15.21
• 5.15.22
• 5.15.23
• 5.15.24
• 5.15.25
• 5.15.26
• 5.15.27
• 5.15.28
• 5.15.29
• 5.15.30
• 5.15.31
• 5.15.32
• 5.15.33
• 5.15.34
• 5.15.35
• 5.15.36
• 5.15.37
• 5.15.38
• 5.15.39
• 5.15.40
• 5.15.41
• 5.15.42
• 5.15.43
• 5.15.44
• 5.15.45
• 5.15.46
• 5.17.0
• 5.17.1
• 5.17.2
• 5.17.3
• 5.17.4
• 5.17.5
• 5.17.6
• 5.17.7
• 5.17.8
• 5.17.9
• 5.17.10
• 5.17.11
• 5.17.12
• 5.17.13
• 5.17.14
• 5.18.0
• 5.18.1
• 5.18.2
• 5.18.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion