CVE-2022-49875: 
Linux Kernel vulnerability analysis and mitigation

A NULL pointer dereference vulnerability (CVE-2022-49875) was identified in the Linux kernel's bpftool component. The vulnerability was discovered when using bpftool to pin {PROG, MAP, LINK} operations without a FILE parameter, which causes a segmentation fault due to strlen triggering a NULL pointer dereference (NVD).

The vulnerability occurs in a specific call stack sequence: dopin -> dopinany -> dopinfd -> mountbpffsforpin -> strlen(name), where the strlen function encounters a NULL pointer dereference. The issue has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access requirements and high impact on availability (NVD).

When exploited, this vulnerability results in a segmentation fault in the bpftool utility, which can lead to system instability or crashes. The vulnerability affects multiple versions of the Linux kernel, including versions from 5.11 up to 5.15.79 and from 5.16 up to 6.0.9 (NVD).

The vulnerability has been resolved by adding validation to the common process in the bpftool implementation. Users are advised to update their Linux kernel to a patched version that includes this fix (NVD).