CVE-2022-3108: Null Pointer Dereference
[Suggested description] An issue was discovered in the Linux kernel through 5.16-rc6. kfdparsesubtypeiolink in drivers/gpu/drm/amd/amdkfd/kfdcrat.c lacks check of the return value of kmemdup().
------------------------------------------
[VulnerabilityType Other] NULL Pointer Dereference
------------------------------------------
[Vendor of Product] the development group
------------------------------------------
[Affected Product Code Base] Linux kernel - 5.16-rc6
------------------------------------------
[Reference] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.19-rc2&id=abfaf0eee97925905e742aa3b0b72e04a918fa9e
------------------------------------------
[Discoverer] Jiasheng Jiang
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.9.1.rt7.166.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.9.1.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.el9_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.rt21.168.el9_1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.17 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-3108?
CVE-2022-3108 is classified as a vulnerability that can lead to a NULL pointer dereference.
How do I fix CVE-2022-3108?
To remediate CVE-2022-3108, update the Linux kernel to one of the patched versions such as 0:4.18.0-372.9.1.rt7.166.el8 or higher.
Which Linux kernel versions are affected by CVE-2022-3108?
CVE-2022-3108 affects Linux kernel versions up to and including 5.16-rc6.
What components in the Linux kernel are involved in CVE-2022-3108?
The CVE-2022-3108 vulnerability is associated with the kfd_parse_subtype_iolink function in the amdkfd driver.
Can CVE-2022-3108 affect systems using specific distributions?
Yes, CVE-2022-3108 can affect systems running vulnerable versions of the Linux kernel across various distributions including Red Hat and Debian.