CVE-2022-4842: Null Pointer Dereference
A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attrpunchhole() was found. A local user could use this flaw to crash the system.
Other sources
A NULL pointer dereference flaw was found in the Linux kernel’s NTFS3 driver. This flaw allows a local user to crash the system.
In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attrpunchhole() in fs/ntfs3/attrib.c that could be triggered by any user.
The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file. The vulnerability is indeed exploitable and reproducible.
Environment:
1. An environment with NTFS3 image mounted. 2. NTFS3 image contains a sparse file or a compressed file.
Reproducing:
1. use fallocate with the option of PUNCHHOLE (i.e. fallocate -p -o 0 -l 5 mntpoint/topunch). 2. NULL pointer dereference should be triggered.
To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.
Reference: https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Linux kernelto a version that resolves this vulnerability.Fixed in 6.2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-4842?
CVE-2022-4842 is considered a critical vulnerability as it allows a local user to crash the system due to a NULL pointer dereference.
How do I fix CVE-2022-4842?
To mitigate CVE-2022-4842, it is recommended to update the Linux kernel to versions 6.2, 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.11-1, or 6.12.12-1.
Who is affected by CVE-2022-4842?
CVE-2022-4842 affects local users on systems running the Linux kernel versions prior to 6.2 and certain versions of the Debian and Red Hat Linux distributions.
What component of the Linux kernel is impacted by CVE-2022-4842?
CVE-2022-4842 specifically impacts the NTFS3 driver in the Linux kernel.
Can CVE-2022-4842 be exploited remotely?
CVE-2022-4842 cannot be exploited remotely, as it requires local user access to the affected system.