Security readout for executives and security teams
Plain-English summary
CVE-2022-49491 is a Linux kernel reliability flaw in the Rockchip display driver. A local, low-privileged user could trigger a kernel NULL pointer dereference, causing a crash or denial of service. It does not indicate data theft or code execution in the provided sources.
Executive priority
Treat as a moderate availability risk for affected Rockchip-based Linux deployments. Prioritize patching for production embedded devices, kiosks, appliances, or systems where a local crash creates operational impact.
Technical view
The issue is CWE-476 in drm/rockchip vop_bind(). If platform_get_resource() returns NULL, resource_size() can dereference it. The kernel fix moves resource_size() after devm_ioremap_resource(), which checks the resource pointer first.
Likely exposure
Exposure is most relevant to Linux systems using affected kernel versions with the Rockchip DRM VOP driver, typically Rockchip-based devices. The source bundle lists Linux kernel impact and stable fix commits, but exact downstream distro status requires vendor verification.
Exploitation context
The CVSS vector is local, low complexity, low privileges, no user interaction, with high availability impact. The source bundle marks KEV as false and provides no evidence of active exploitation or public weaponization.
Researcher notes
Key indicators are CWE-476 and CVSS 5.5: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The provided evidence supports denial of service through NULL pointer dereference only, not confidentiality impact, integrity impact, or remote exploitation.
Mitigation direction
- Upgrade to a kernel version containing the referenced stable fix commits.
- Use vendor-supported kernel packages or device firmware where available.
- Verify downstream distro or appliance advisories for backported fixes.
- If patching is delayed, follow vendor guidance; no separate workaround is named.
Validation and detection
- Inventory Linux systems and devices using Rockchip kernels or boards.
- Check whether the Rockchip DRM VOP driver is present or enabled.
- Compare kernel version and source package against the referenced stable commits.
- Confirm vendor kernel advisories or changelogs include the vop_bind() fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49491 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/452922955df215a417c80d09dab72bbc667a1861CVE reference, Linux
- https://git.kernel.org/stable/c/fcd6a886443730c39170b8383411e52118aec0a3CVE reference, Linux
- https://git.kernel.org/stable/c/6ff986e057bf28e2f7690dad410768b2270f9453CVE reference, Linux
- https://git.kernel.org/stable/c/a9b4599665e437de8a1152799c34841b799a2e1cCVE reference, Linux
- https://git.kernel.org/stable/c/3451852312303d54a003c73bd0ae39cebb960bd5CVE reference, Linux
- https://git.kernel.org/stable/c/b54926bd558d97c888c3d2d87886f3c159d3254aCVE reference, Linux
- https://git.kernel.org/stable/c/769c53bb6116d0eaec0f1fe4ec4b27a74465cad1CVE reference, Linux
- https://git.kernel.org/stable/c/ecfa52654d0c9c333c1fe1611f47105f6bce9591CVE reference, Linux
- https://git.kernel.org/stable/c/f8c242908ad15bbd604d3bcb54961b7d454c43f8CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.