CVE-2022-49065

MEDIUM

Linux Kernel 4.17-5.10.111, 5.11-5.15.34, 5.16-5.17.3 - NULL Pointer Dereference in SUNRPC Trace Event Handler

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix the svc_deferred_event trace class Fix a NULL deref crash that occurs when an svc_rqst is deferred while the sunrpc tracing subsystem is enabled. svc_revisit() sets dr->xprt to NULL, so it can't be relied upon in the tracepoint to provide the remote's address. Unfortunately we can't revert the "svc_deferred_class" hunk in commit ece200ddd54b ("sunrpc: Save remote presentation address in svc_xprt for trace events") because there is now a specific check of event format specifiers for unsafe dereferences. The warning that check emits is: event svc_defer_recv has unsafe dereference of argument 1 A "%pISpc" format specifier with a "struct sockaddr *" is indeed flagged by this check. Instead, take the brute-force approach used by the svcrdma_qp_error tracepoint. Convert the dr::addr field into a presentation address in the TP_fast_assign() arm of the trace event, and store that as a string. This fix can be backported to -stable kernels. In the meantime, commit c6ced22997ad ("tracing: Update print fmt check to handle new __get_sockaddr() macro") is now in v5.18, so this wonky fix can be replaced with __sockaddr() and friends properly during the v5.19 merge window.

Scores

CVSS v3 5.5
EPSS 0.0025
EPSS Percentile 15.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-476
Status published
Products (15)
linux/Kernel 4.17.0 - 5.10.112linux
linux/Kernel 5.11.0 - 5.15.35linux
linux/Kernel 5.16.0 - 5.17.4linux
Linux/Linux < 4.17
Linux/Linux 4.17
Linux/Linux 5.10.112 - 5.10.*
Linux/Linux 5.15.35 - 5.15.*
Linux/Linux 5.17.4 - 5.17.*
Linux/Linux 5.18
Linux/Linux ece200ddd54b9ce840cfee554fb812560c545c7d - 4d5004451ab2218eab94a30e1841462c9316ba19
... and 5 more
Published Feb 26, 2025
Tracked Since Feb 18, 2026