CVE-2022-48713

Severity CVSS v4.0:
Pending analysis
Type:
CWE-476 NULL Pointer Dereference
Publication date:
20/06/2024
Last modified:
17/09/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> perf/x86/intel/pt: Fix crash with stop filters in single-range mode<br /> <br /> Add a check for !buf-&gt;single before calling pt_buffer_region_size in a<br /> place where a missing check can cause a kernel crash.<br /> <br /> Fixes a bug introduced by commit 670638477aed ("perf/x86/intel/pt:<br /> Opportunistically use single range output mode"), which added a<br /> support for PT single-range output mode. Since that commit if a PT<br /> stop filter range is hit while tracing, the kernel will crash because<br /> of a null pointer dereference in pt_handle_status due to calling<br /> pt_buffer_region_size without a ToPA configured.<br /> <br /> The commit which introduced single-range mode guarded almost all uses of<br /> the ToPA buffer variables with checks of the buf-&gt;single variable, but<br /> missed the case where tracing was stopped by the PT hardware, which<br /> happens when execution hits a configured stop filter.<br /> <br /> Tested that hitting a stop filter while PT recording successfully<br /> records a trace with this patch but crashes without this patch.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.5 (including) 5.10.99 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.22 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 5.16.8 (excluding)
cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*