CVE-2022-49285 is a vulnerability identified in the Linux kernel specifically within the Industrial I/O (IIO) subsystem's accelerometer driver for the MMA8452 sensor. The issue arises from incorrect logic used to retrieve the mma8452_data structure associated with the device. Originally, the code attempted to obtain the i2c_client pointer by casting the device pointer (dev) directly using to_i2c_client(), which is incorrect because dev points to the device belonging to iio_dev, not directly to the i2c_client. This flawed approach worked only incidentally due to the use of dev->driver_data to get iio_dev, but it was confusing and fragile. After a kernel commit (8b7651f25962) that removed unnecessary self drvdata in iio_device_alloc(), the previous workaround no longer functioned correctly. Consequently, when user space tries to access available scale information, the kernel encounters a NULL pointer dereference, leading to a kernel crash (kernel dump). The correct fix involves using dev_to_iio_dev() to properly convert the device pointer to the iio_dev structure and then accessing mma8452_data via iio_priv(dev_get_drvdata(dev)). This vulnerability is a logic error in device driver code that can cause a denial of service through kernel crashes when interacting with the affected accelerometer device. The issue does not appear to allow privilege escalation or arbitrary code execution but results in system instability when triggered. There are no known exploits in the wild, and no CVSS score has been assigned yet. The vulnerability affects Linux kernel versions containing the flawed logic, as identified by the commit hashes provided.

For European organizations, the primary impact of CVE-2022-49285 is potential system instability and denial of service on Linux systems utilizing the MMA8452 accelerometer driver within the Industrial I/O subsystem. This is particularly relevant for embedded systems, IoT devices, or specialized industrial equipment running Linux kernels with the vulnerable driver code. Systems that rely on sensor data from the MMA8452 accelerometer could experience kernel panics or crashes when user space queries scale information, leading to operational disruptions. Although this vulnerability does not directly compromise confidentiality or integrity, the availability impact can be significant in environments where uptime and reliability are critical, such as manufacturing, automotive, or medical devices. European organizations deploying Linux-based embedded devices or industrial control systems with this driver should be aware of the risk of unexpected reboots or system failures. Since no known exploits exist, the risk of targeted attacks exploiting this vulnerability is currently low, but unpatched systems remain susceptible to accidental or malicious triggering of the kernel crash. The impact is thus mainly on availability and operational continuity rather than data breach or privilege escalation.

To mitigate CVE-2022-49285, European organizations should: 1) Identify all Linux systems and embedded devices using the MMA8452 accelerometer driver within the Industrial I/O subsystem. This includes checking kernel versions and device drivers for the presence of the vulnerable code. 2) Apply the official Linux kernel patches that correct the driver logic by replacing the incorrect to_i2c_client() usage with dev_to_iio_dev() and proper access to mma8452_data. If official patches are not yet available, consider backporting the fix from the relevant kernel commit or upgrading to a kernel version that includes the fix. 3) Test patched kernels thoroughly in controlled environments to ensure stability and compatibility with existing hardware and software. 4) Implement monitoring for kernel crashes or unexpected reboots on affected devices to detect potential triggering of this vulnerability. 5) For critical embedded or industrial systems where kernel updates are challenging, consider isolating affected devices from untrusted user space inputs or restricting access to interfaces that query the accelerometer scale information. 6) Maintain an inventory of devices with this driver and track Linux kernel updates to promptly apply future security patches. These steps go beyond generic advice by focusing on identifying affected embedded and industrial Linux systems, applying targeted patches, and monitoring for availability impacts.