CVE-2022-50731

Vulnerability

Overview

CVE-2022-50731 is a NULL pointer dereference vulnerability in the Linux kernel's cryptographic asynchronous key cipher (akcipher) subsystem. Multiple akcipher implementations, such as ECDSA, only support signature verification and therefore do not provide all callback functions. When a caller (e.g., the in-kernel test manager) attempts to set a private key on such a transform, the set_priv_key callback pointer is NULL, leading to a kernel crash.

Root

Cause

The akcipher API previously introduced default stubs for sign and verify operations that simply return an error [1]. However, a corresponding default stub for set_priv_key was not provided. Consequently, any akcipher algorithm lacking its own set_priv_key implementation causes a NULL pointer dereference when a private key is set—an operation that typically precedes a signature generation request [1].

Impact

An attacker who can trigger the use of an akcipher without a set_priv_key callback (e.g., through crafted test vectors or specific crypto API usage) can cause a kernel crash, resulting in a denial of service denial-of-service condition. The vulnerability does not require authentication and can be exploited locally by unprivileged users able to invoke cryptographic operations [1].

Mitigation

The fix was applied in Linux kernel stable commits [1][2]. Users should update to a kernel version containing the patch that adds a default set_priv_key stub returning an appropriate error, preventing the NULL pointer dereference. The vulnerability does not have a known workaround other than applying the kernel update.