CVE-2022-49827

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()

drm_vblank_init() call drmm_add_action_or_reset() with

drm_vblank_init_release() as action. If __drmm_add_action() failed, will

directly call drm_vblank_init_release() with the vblank whose worker is

NULL. As the resule, a null-ptr-deref will happen in

kthread_destroy_worker(). Add the NULL check before calling

drm_vblank_destroy_worker().

BUG: null-ptr-deref

KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]

CPU: 5 PID: 961 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf-dirty

RIP: 0010:kthread_destroy_worker+0x25/0xb0

Call Trace:

<TASK>

drm_vblank_init_release+0x124/0x220 [drm]

? drm_crtc_vblank_restore+0x8b0/0x8b0 [drm]

__drmm_add_action_or_reset+0x41/0x50 [drm]

drm_vblank_init+0x282/0x310 [drm]

vkms_init+0x35f/0x1000 [vkms]

? 0xffffffffc4508000

? lock_is_held_type+0xd7/0x130

? __kmem_ca

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References