CVE-2022-50826

Vulnerability

CVE-2022-50826 is a NULL pointer dereference vulnerability in the Linux kernel's ipu3-imgu driver, specifically in the imgu_subdev_set_selection() function. The issue occurs when the function is called with a NULL subdev state, causing v4l2_subdev_get_try_crop() and v4l2_subdev_get_try_compose() to dereference the NULL pointer. This is a similar flaw to one previously fixed in imgu_subdev_get_selection() with commit 30d03a0de650 [1].

Exploitation

The vulnerability can be triggered by an attacker who can invoke imgu_subdev_set_selection() with a NULL state argument. This requires local access to the system and the ability to interact with the video4linux subsystem, likely through the Intel IPU3 camera driver. No authentication is needed beyond local user access to the device file.

Impact

A successful exploit results in a NULL pointer dereference, leading to a kernel crash (denial of service). This can render the system unavailable until reboot. There is no evidence of privilege escalation or data leakage from the available information.

Mitigation

Patches are available in the Linux kernel stable branches [1][2]. Users should update their kernel to a version containing the fix. There are no known workarounds aside from applying the patch or disabling the affected driver if not needed.