CVE-2022-49134

Summary

CVE-2022-49134 is a vulnerability affecting the Linux kernel's mlxsw driver. The issue arises when the driver fails to adequately protect itself from events reported for the CPU port (local port 0), even though it exists but lacks complete field initialization. Consequently, a NULL pointer dereference can occur when attempting to access uninitialized 'struct mlxsw_sp_port' fields. This vulnerability has been addressed through commit 63b08b1f6834, which implements early bailout when processing a PUDE event reported for the CPU port. To enhance security further, the code now incorporates a common function to check for invalid local ports, ensuring proper protection in all relevant locations.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.