CVE-2022-49433: Software Security Vulnerability Vulnerability

MODERATE
Advisory Identifier: GHSA-g569-wg4c-8crr
Share
CVSS 5.5
CWE-908
Published
Advisory Summary

CVE-2022-49433 is a MODERATE (CVSS 5.5) security vulnerability vulnerability (CWE-908: Use of Uninitialized Resource) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product uses or accesses a resource that has not been initialized.. Remediation is available in the latest vendor maintenance releases.

CVE-2022-49433 at a Glance

CVE Identifier CVE-2022-49433
GHSA Identifier GHSA-g569-wg4c-8crr
Severity MODERATE
CVSS v3.1 Base Score 5.5
CWE Classification CWE-908: Use of Uninitialized Resource
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 5.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2022-49433

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2022-49433, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-908: Use of Uninitialized Resource, where the product uses or accesses a resource that has not been initialized. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Prevent use of lock before it is initialized If there is a failure during probe of hfi1 before the sdma_map_lock is initialized, the call to hfi1_free_devdata() will attempt to use a lock that has not been initialized. If the locking correctness validator is on then an INFO message and stack trace resembling the following may be seen: INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. Call Trace: register_lock_class+0x11b/0x880 __lock_acquire+0xf3/0x7930 lock_acquire+0xff/0x2d0 _raw_spin_lock_irq+0x46/0x60 sdma_clean+0x42a/0x660 [hfi1] hfi1_free_devdata+0x3a7/0x420 [hfi1] init_one+0x867/0x11a0 [hfi1] pci_device_probe+0x40e/0x8d0 The use of sdma_map_lock in sdma_clean() is for freeing the sdma_map memory, and sdma_map is not allocated/initialized until after sdma_map_lock has been initialized. This code only needs to be run if sdma_map is not NULL, and so checking for that condition will avoid trying to use the lock before it is initialized.

References

NVD — CVE-2022-49433 NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-49433
git.kernel.org/stable/c/05c03dfd09... WEB
https://git.kernel.org/stable/c/05c03dfd09c069c4ffd783b47b2da5dcc9421f2c
git.kernel.org/stable/c/288d198f50... WEB
https://git.kernel.org/stable/c/288d198f50434f29b4a26a9de4394ae2305ad8af
git.kernel.org/stable/c/30eb275e7e... WEB
https://git.kernel.org/stable/c/30eb275e7ed588270ae159cc590a96658e0cfd8f
git.kernel.org/stable/c/66090815a2... WEB
https://git.kernel.org/stable/c/66090815a24ce14cf51ef5453fc0218fe8a39bc2
git.kernel.org/stable/c/addb192000... WEB
https://git.kernel.org/stable/c/addb192000d8819c0b1553453994df9bb54c28db
git.kernel.org/stable/c/ca55150bff... WEB
https://git.kernel.org/stable/c/ca55150bff5817af4f857a746ecab9862c23e12a
git.kernel.org/stable/c/fc0750e659... WEB
https://git.kernel.org/stable/c/fc0750e659db7b315bf6348902cc8ca3cdd4b8d8

Frequently Asked Questions

What is CVE-2022-49433?
CVE-2022-49433 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-908: Use of Uninitialized Resource.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2022-49433?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2022-49433?
CVE-2022-49433 has a CVSS v3.1 base score of 5.5 (MODERATE) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2022-49433?
CVE-2022-49433 is classified under CWE-908: Use of Uninitialized Resource (The product uses or accesses a resource that has not been initialized.).
How can I check Maven dependencies for CVE-2022-49433?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-g569-wg4c-8crr",
  "modified" : "2025-10-22T18:30:31Z",
  "published" : "2025-10-22T18:30:30Z",
  "aliases" : [ "CVE-2022-49433" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hfi1: Prevent use of lock before it is initialized\n\nIf there is a failure during probe of hfi1 before the sdma_map_lock is\ninitialized, the call to hfi1_free_devdata() will attempt to use a lock\nthat has not been initialized. If the locking correctness validator is on\nthen an INFO message and stack trace resembling the following may be seen:\n\n  INFO: trying to register non-static key.\n  The code is fine but needs lockdep annotation, or maybe\n  you didn't initialize this object before use?\n  turning off the locking correctness validator.\n  Call Trace:\n  register_lock_class+0x11b/0x880\n  __lock_acquire+0xf3/0x7930\n  lock_acquire+0xff/0x2d0\n  _raw_spin_lock_irq+0x46/0x60\n  sdma_clean+0x42a/0x660 [hfi1]\n  hfi1_free_devdata+0x3a7/0x420 [hfi1]\n  init_one+0x867/0x11a0 [hfi1]\n  pci_device_probe+0x40e/0x8d0\n\nThe use of sdma_map_lock in sdma_clean() is for freeing the sdma_map\nmemory, and sdma_map is not allocated/initialized until after\nsdma_map_lock has been initialized. This code only needs to be run if\nsdma_map is not NULL, and so checking for that condition will avoid trying\nto use the lock before it is initialized.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-49433"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/05c03dfd09c069c4ffd783b47b2da5dcc9421f2c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/288d198f50434f29b4a26a9de4394ae2305ad8af"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/30eb275e7ed588270ae159cc590a96658e0cfd8f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/66090815a24ce14cf51ef5453fc0218fe8a39bc2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/addb192000d8819c0b1553453994df9bb54c28db"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ca55150bff5817af4f857a746ecab9862c23e12a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fc0750e659db7b315bf6348902cc8ca3cdd4b8d8"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-908" ],
    "severity" : "MODERATE",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2025-02-26T07:01:19Z"
  }
}