CVE-2022-0168: Null Pointer Dereference
First published: Wed Jan 05 2022(Updated: )
A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c Common Internet File System (CIFS) due to an incorrect return from the memdup_user function. This flaw allows a local, privileged (CAP_SYS_ADMIN) attacker to crash the system.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:4.18.0-425.3.1.rt7.213.el8 | 0:4.18.0-425.3.1.rt7.213.el8 |
| redhat/kernel | <0:4.18.0-425.3.1.el8 | 0:4.18.0-425.3.1.el8 |
| redhat/kernel | <0:5.14.0-162.6.1.el9_1 | 0:5.14.0-162.6.1.el9_1 |
| redhat/kernel-rt | <0:5.14.0-162.6.1.rt21.168.el9_1 | 0:5.14.0-162.6.1.rt21.168.el9_1 |
| Linux kernel | <5.18 | |
| Red Hat Enterprise Linux | =8.0 | |
| Red Hat Enterprise Linux | =9.0 | |
| debian/linux | 5.10.223-1 5.10.234-1 6.1.129-1 6.1.133-1 6.12.21-1 6.12.22-1 |
Remedy
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2022-0168 https://nvd.nist.gov/vuln/detail/CVE-2022-0168
- https://bugzilla.redhat.com/show_bug.cgi?id=2037386
- https://access.redhat.com/errata/RHSA-2022:7444
- https://access.redhat.com/errata/RHSA-2022:7683
- https://access.redhat.com/errata/RHSA-2022:8267
- https://access.redhat.com/errata/RHSA-2022:7933
- https://access.redhat.com/security/cve/cve-2022-0168
- https://access.redhat.com/security/cve/CVE-2022-0168
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d6f5e358452479fa8a773b5c6ccc9e4ec5a20880
- https://launchpad.net/bugs/cve/CVE-2022-0168
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2067080
- https://git.kernel.org/linus/d6f5e358452479fa8a773b5c6ccc9e4ec5a20880
- https://access.redhat.com/errata/RHSA-2024:0724
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0168
- https://nvd.nist.gov/vuln/detail/CVE-2022-0168
- https://security-tracker.debian.org/tracker/CVE-2022-0168
- https://ubuntu.com/security/CVE-2022-0168
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the severity of CVE-2022-0168?
CVE-2022-0168 is a high severity vulnerability that allows local, privileged attackers to cause a denial of service in the Linux kernel.
How do I fix CVE-2022-0168?
To fix CVE-2022-0168, update to the patched kernel versions provided by Red Hat or Debian as specified in the security advisories.
Who is affected by CVE-2022-0168?
CVE-2022-0168 affects users of certain versions of the Linux kernel, specifically on Red Hat Enterprise Linux and Debian systems.
What type of vulnerability is CVE-2022-0168?
CVE-2022-0168 is a denial of service vulnerability that results from improper handling in the smb2_ioctl_query_info function.
Can CVE-2022-0168 be exploited remotely?
No, CVE-2022-0168 can only be exploited locally by a privileged user with CAP_SYS_ADMIN capabilities.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/weakness
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-0168
- collector/mitre-cve
- source/MITRE
- collector/usn-cve
- source/Ubuntu
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/description
- agent/event
- agent/trending
- agent/source
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/tags
- agent/softwarecombine
- collector/security-tracker-debian
- source/Debian
- package-manager/redhat
- vendor/linux
- canonical/linux kernel
- vendor/redhat
- canonical/red hat enterprise linux
- version/red hat enterprise linux/8.0
- version/red hat enterprise linux/9.0
- package-manager/debian