CVE-2022-48713 is a vulnerability in the Linux kernel specifically related to the Intel Processor Trace (PT) functionality within the perf subsystem on x86 architectures. The issue arises from a missing check in the code handling PT single-range output mode, introduced by a prior commit (670638477aed) that added support for this mode. When a PT stop filter range is hit during tracing, the kernel attempts to call pt_buffer_region_size without verifying if a Top of Physical Address (ToPA) buffer is configured. This missing check leads to a null pointer dereference in the pt_handle_status function, causing the kernel to crash. The vulnerability is triggered when tracing is stopped by the PT hardware due to execution hitting a configured stop filter. The patch adds a necessary check for the buf->single flag before calling pt_buffer_region_size, preventing the crash and allowing successful trace recording. This bug affects Linux kernel versions containing the faulty commit and is specifically related to the perf/x86/intel/pt subsystem's handling of single-range mode and stop filters. There are no known exploits in the wild at this time, and no CVSS score has been assigned yet.

For European organizations relying on Linux systems, especially those using Intel processors and leveraging the perf tool for performance monitoring and tracing, this vulnerability could lead to unexpected kernel crashes. Such crashes can cause system instability, potential denial of service (DoS), and interruptions in critical services. Organizations running production workloads, servers, or embedded systems with affected Linux kernel versions may experience downtime or degraded performance. Although the vulnerability does not appear to allow privilege escalation or data leakage, the availability impact could be significant in environments where uptime and reliability are critical, such as financial institutions, healthcare providers, and industrial control systems. Additionally, kernel crashes can complicate forensic analysis and incident response if they occur during active investigations or monitoring.

European organizations should promptly apply the patch that adds the missing buf->single check in the perf/x86/intel/pt subsystem to prevent kernel crashes caused by this vulnerability. Specifically, updating the Linux kernel to a version that includes the fix for CVE-2022-48713 is essential. For environments where immediate patching is not feasible, temporarily disabling Intel PT tracing or avoiding the use of PT stop filters in single-range mode can mitigate the risk of triggering the crash. System administrators should also monitor kernel logs for signs of pt_handle_status crashes and implement robust kernel crash recovery mechanisms. Additionally, organizations should ensure that their performance monitoring tools and scripts are updated to avoid configurations that could trigger this vulnerability. Regular kernel updates and testing in staging environments before deployment will help maintain system stability and security.