Null Pointer Dereference in Linux Kernel's TIPC Server Component

CVE-2022-50555

What is CVE-2022-50555?

A null pointer dereference vulnerability exists in the TIPC server component of the Linux Kernel. This flaw can lead to system crashes or unintended behavior when the server component attempts to access a listener that may have been set to null. The issue was detected during a code review, discovering that the listener can be improperly referenced due to a lack of adequate checks in the tipc_topsrv_accept function. Mitigations include implementing checks on the listener while under lock protection and ensuring the sequence of operations is maintained to prevent premature resource release. Prompt patching is advised for all affected versions to secure against potential exploitation.

References