CVE-2022-48762: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48762 affects the Linux kernel's arm64 exception table handling. The vulnerability was discovered in the load_unaligned_zeropad() function where register indices were incorrectly extracted from ex->type instead of ex->data. This issue was fixed in January 2022 (Kernel Commit).

The vulnerability exists in the ex_handler_load_unaligned_zeropad() function where it erroneously extracts data and address register indices from ex->type rather than ex->data. Since ex->type contains EX_TYPE_LOAD_UNALIGNED_ZEROPAD (value 4), this causes X0 to be always treated as the address register and X4 as the data register. The CVSS 3.1 base score is 6.2 MEDIUM (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) (NVD).

This vulnerability can lead to a NULL pointer dereference when attempting to access arbitrary addresses through X0, which may contain arbitrary values. Additionally, it can corrupt X4 register data causing unpredictable behavior within the load_unaligned_zeropad() function and its caller (Kernel Commit).

The vulnerability can be triggered on MTE-enabled systems, leading to kernel crashes. A proof-of-concept crash has been documented showing a NULL pointer dereference at virtual address 0x0 during filesystem operations (Kernel Commit).

The issue has been fixed by modifying the code to correctly extract register indices from ex->data instead of ex->type. The fix was implemented in the Linux kernel through commit 3758a6c74e08 (Kernel Commit).