Null Pointer Dereference in IBM Power 9 Linux Kernel SCSI Driver

CVE-2022-49703

What is CVE-2022-49703?

A vulnerability in the Linux kernel's SCSI driver for IBM Power 9 hardware can lead to a null pointer dereference under specific circumstances. During the allocation of sub-channel request queues (subcrqs), the back pointer from the queue to the vhost adapter is not assigned until after registering interrupt requests. This could result in a crash if a pending subcrq interrupt is replayed upon IRQ registration, allowing the kernel to attempt to read from an invalid memory address. This problem was particularly noted during kexec/kdump scenarios. Implementing a fix ensures that the back pointer is correctly set during initial allocation, mitigating the risk of dereferencing invalid memory and preventing the potential crash.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References