NULL Pointer Dereference Affecting kernel-zfcpdump package, versions <5.14.21-150400.24.158.1


Severity

Recommended
0.0
medium
0
10

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.02% (4th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES154-KERNELZFCPDUMP-9529689
  • published27 Mar 2025
  • disclosed26 Mar 2025

Introduced: 26 Mar 2025

CVE-2022-49187  (opens in a new tab)
CWE-476  (opens in a new tab)

How to fix?

Upgrade SLES:15.4 kernel-zfcpdump to version 5.14.21-150400.24.158.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-zfcpdump package and not the kernel-zfcpdump package as distributed by SLES. See How to fix? for SLES:15.4 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

clk: Fix clk_hw_get_clk() when dev is NULL

Any registered clk_core structure can have a NULL pointer in its dev field. While never actually documented, this is evidenced by the wide usage of clk_register and clk_hw_register with a NULL device pointer, and the fact that the core of_clk_hw_register() function also passes a NULL device pointer.

A call to clk_hw_get_clk() on a clk_hw struct whose clk_core is in that case will result in a NULL pointer derefence when it calls dev_name() on that NULL device pointer.

Add a test for this case and use NULL as the dev_id if the device pointer is NULL.

CVSS Base Scores

version 3.1