VDB

UBUNTU-CVE-2022-4842

UBUNTU-CVE-2022-4842 PUBLISHED CVSS 5.5 MEDIUM

Record from OSV · Published January 12, 2023

A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user could use this flaw to crash the system.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
linux-aws-5.15Ubuntu:20.04:LTS5.15.0-1034.38~20.04.1
linux-ibmUbuntu:22.04:LTS5.15.0-1028.31
linux-azureUbuntu:22.04:LTS5.15.0-1036.43
linux-hwe-5.19Ubuntu:22.04:LTS5.19.0-42.43~22.04.1
linux-lowlatency-hwe-5.15Ubuntu:20.04:LTS5.15.0-70.77~20.04.1
linux-realtimeUbuntu:Pro:Realtime:22.04:LTS5.15.0-1036.39
linux-oem-5.17Ubuntu:22.04:LTS5.17.0-1034.35
linux-gke-5.15Ubuntu:20.04:LTS5.15.0-1031.36~20.04.1
linux-nvidiaUbuntu:22.04:LTS5.15.0-1023.23
linux-gkeop-5.15Ubuntu:20.04:LTS5.15.0-1018.23~20.04.1
linux-oem-6.0Ubuntu:22.04:LTS6.0.0-1019.19
linux-oracleUbuntu:22.04:LTS5.15.0-1033.39

24 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersions
Ubuntu:16.04:LTSlinux-hwe-edge4.8.0-28.30~16.04.1, 4.8.0-32.34~16.04.1, 4.8.0-34.36~16.04.1
Ubuntu:20.04:LTSlinux-aws-5.85.8.0-1038.40~20.04.1, 5.8.0-1035.37~20.04.1, 0
Ubuntu:20.04:LTSlinux-oracle-5.85.8.0-1033.34~20.04.1, 5.8.0-1034.35~20.04.2, 5.8.0-1037.38~20.04.1
Ubuntu:18.04:LTSlinux-gkeop-5.45.4.0-1021.22~18.04.1, 5.4.0-1018.19~18.04.1, 5.4.0-1015.16~18.04.1
Ubuntu:20.04:LTSlinux-aws-5.155.15.0-1031.35~20.04.1, 0, 5.15.0-1014.18~20.04.1
Ubuntu:18.04:LTSlinux-aws-5.35.3.0-1017.18~18.04.1, 5.3.0-1016.17~18.04.1, 5.3.0-1019.21~18.04.1
Ubuntu:22.04:LTSlinux-ibm5.15.0-1021.24, 5.15.0-1018.21, 5.15.0-1017.20
Ubuntu:22.04:LTSlinux-azure5.15.0-1002.3, 5.15.0-1035.42, 5.15.0-1034.41
Ubuntu:18.04:LTSlinux-gke-4.154.15.0-1057.60, 0, 4.15.0-1030.32
Ubuntu:18.04:LTSlinux-oracle-5.30, 5.3.0-1027.29~18.04.1, 5.3.0-1024.26~18.04.1
Ubuntu:22.04:LTSlinux-hwe-5.195.19.0-38.39~22.04.1, 5.19.0-32.33~22.04.1, 5.19.0-28.29~22.04.1
Ubuntu:20.04:LTSlinux-lowlatency-hwe-5.155.15.0-48.54~20.04.1, 5.15.0-33.34~20.04.1, 5.15.0-42.45~20.04.1
Ubuntu:20.04:LTSlinux-raspi25.3.0-1014.16, 5.3.0-1015.17, 5.3.0-1017.19
Ubuntu:Pro:Realtime:22.04:LTSlinux-realtime5.15.0-1021.21, 5.15.0-1020.20, 5.15.0-1019.19
Ubuntu:18.04:LTSlinux-gcp4.15.0-1042.45, 4.15.0-1044.70, 5.0.0-1020.20~18.04.1
Ubuntu:22.04:LTSlinux-riscv5.15.0-1019.22, 5.15.0-1007.7, 5.15.0-1008.8
Ubuntu:18.04:LTSlinux-gcp-5.35.3.0-1020.22~18.04.1, 5.3.0-1032.34~18.04.1, 0
Ubuntu:22.04:LTSlinux-oem-5.175.17.0-1030.31, 5.17.0-1020.21, 5.17.0-1019.20
Ubuntu:18.04:LTSlinux-oracle-5.05.0.0-1011.16, 5.0.0-1014.19, 5.0.0-1007.12~18.04.1
Ubuntu:18.04:LTSlinux-aws-5.00, 5.0.0-1027.30, 5.0.0-1025.28

…and 57 more

Timeline

  • Jan 12, 2023 CVE Published
  • Apr 22, 2026 CVE Updated
  • Oct 30, 2026 Distribution Patch (10 in total, the first dated here)
  • Oct 30, 2026 Security Advisory (10 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln UBUNTU-CVE-2022-4842
vulnetix vdb fixes UBUNTU-CVE-2022-4842

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/UBUNTU-CVE-2022-4842/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›