Security readout for executives and security teams
Plain-English summary
CVE-2022-49392 is a Linux kernel bug in the Aspeed virtual UART driver. A local, low-privileged user could trigger a kernel NULL pointer dereference, causing a crash or service disruption. The stated impact is availability, not data theft or modification.
Executive priority
Address during normal vulnerability remediation, faster for systems where local users can access impacted Linux hosts. Business risk is service interruption rather than confidentiality loss, and current sources do not show active exploitation.
Technical view
In 8250_aspeed_vuart, aspeed_vuart_probe did not safely handle platform_get_resource() returning NULL. The resolved issue adds checking before dereference. The bundle maps this to CWE-476 and CVSS 3.1 score 5.5: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Likely exposure
Exposure appears limited to Linux systems using the Aspeed VUART 8250 driver path and vulnerable kernel versions or commits listed in the CVE bundle. Systems without this driver path are less likely to be exposed.
Exploitation context
The CVSS vector indicates local access and low privileges are required, with no user interaction. The source bundle does not identify active exploitation, and KEV status is false. Treat this as a denial-of-service risk pending vendor-specific assessment.
Researcher notes
Evidence is concise and kernel-fix oriented. The key condition is platform_get_resource() failure inside aspeed_vuart_probe leading to NULL dereference. The bundle does not provide a proof of concept, exploitation reports, or product-specific downstream package status.
Mitigation direction
- Check Linux vendor advisories for the fixed kernel package or stable commit.
- Prioritize systems using Aspeed VUART or affected BMC-related hardware paths.
- Upgrade affected kernels through normal vendor-supported channels.
- If upgrade is delayed, limit local access to exposed systems.
Validation and detection
- Inventory kernel versions against the CVE affected version data.
- Confirm whether the Aspeed 8250 VUART driver is present or used.
- Verify vendor packages include one of the referenced stable fixes.
- Review crash logs for NULL dereference symptoms in the driver path.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49392 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/923d34ce069e8e51a4d003caa6b66a8cd6ecd0edCVE reference, Linux
- https://git.kernel.org/stable/c/90a6b6fc52bfdcfe9698454bf5bea26112abbcd1CVE reference, Linux
- https://git.kernel.org/stable/c/d5f1275f101e0e8a172d300d897f5a12e87e3485CVE reference, Linux
- https://git.kernel.org/stable/c/0e0fd55719fa081de6f9e5d9e6cef48efb04d34aCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.