CVE-2022-50888

Root

Cause In the Linux kernel's q6v5_wcss_init_mmio() function, platform_get_resource_byname() can return NULL if the requested resource is not found. The return value is not checked before being passed to devm_ioremap(), leading to a potential null-pointer dereference when accessing res->start. [1]

Exploitation

An attacker with local access or the ability to trigger the remoteproc probe path could exploit this by causing platform_get_resource_byname() to fail, e.g., by manipulating device tree or system resources. No authentication is needed beyond local access, but the attack surface is limited to systems using the affected Qualcomm remoteproc driver.

Impact

A successful exploit results in a kernel NULL pointer dereference, causing a system crash (denial of service). No privilege escalation or data corruption is expected from this bug.

Mitigation

The vulnerability is fixed in the Linux kernel by adding a return value check for platform_get_resource_byname() and returning an error if it fails. Users should apply the patch available through the stable kernel repository. [1]