CVE-2022-49731

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-49731
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49731.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-49731
Downstream
Related
Published
2025-02-26T02:24:41.300Z
Modified
2026-04-11T12:44:27.742083Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
Details

In the Linux kernel, the following vulnerability has been resolved:

ata: libata-core: fix NULL pointer deref in atahostalloc_pinfo()

In an unlikely (and probably wrong?) case that the 'ppi' parameter of atahostallocpinfo() points to an array starting with a NULL pointer, there's going to be a kernel oops as the 'pi' local variable won't get reassigned from the initial value of NULL. Initialize 'pi' instead to '&atadummyportinfo' to fix the possible kernel oops for good...

Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49731.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f5cda257296fbd3683b1f568f2d94d3caaacf74d
Fixed
ca4693e6e06e4fd2b240c0fec47aa2498c94848e
Fixed
1ac5efee33f29e704226506d429b84575a5d66f8
Fixed
a810bd5af06977a847d1f202b22d7defd5c62497
Fixed
253334f84c81bc6a43af489f108c0bddad989eef
Fixed
36cd19e7d4e5571d77a2ed20c5b6ef50cf57734a
Fixed
ff128fbea720bf763fa345680dda5f050bc24a47
Fixed
07cbdb4807d369fbda73062a91b570c4dc5ec429
Fixed
bf476fe22aa1851bab4728e0c49025a6a0bea307

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49731.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.22
Fixed
4.9.320
Type
ECOSYSTEM
Events
Introduced
4.10.0
Fixed
4.14.285
Type
ECOSYSTEM
Events
Introduced
4.15.0
Fixed
4.19.249
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.200
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.124
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.49
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
5.18.6

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49731.json"