CVE-2022-48703: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48703 affects the Linux kernel's thermal/int340x_thermal driver. The vulnerability was discovered when the Global Device Data Vault (GDDV) returns a package with a zero-length buffer, causing kmemdup() to return ZERO_SIZE_PTR (0x10), which leads to a NULL pointer dereference in the data_vault_read() function. The issue was publicly disclosed on May 3, 2024 (NVD).

The vulnerability occurs in the Linux kernel's thermal management subsystem, specifically in the int340x_thermal driver. When handling data_vault values, if the GDDV returns a package with a zero-length buffer, kmemdup() returns ZERO_SIZE_PTR (0x10). This causes a NULL pointer dereference when accessing the 0x10 value in data_vault, resulting in a kernel bug with the error message 'BUG: kernel NULL pointer dereference, address: 0000000000000010' (Kernel Commit).

The vulnerability can cause a kernel NULL pointer dereference, potentially leading to system crashes or denial of service conditions on affected Linux systems using the int340x_thermal driver (NVD).

The vulnerability requires local access to a system with the affected thermal driver. There are no known reports of this vulnerability being exploited in the wild (NVD).

The issue has been patched by implementing proper checking of ZERO_SIZE_PTR values using ZERO_OR_NULL_PTR() for checking ZERO_SIZE_PTR or NULL value in data_vault. The fix has been merged into the Linux kernel (Kernel Commit).