CVE-2024-53222: zram: fix NULL pointer in comp_algorithm_show()
In the Linux kernel, the following vulnerability has been resolved:
zram: fix NULL pointer in compalgorithmshow()
LTP reported a NULL pointer dereference as followed:
CPU: 7 UID: 0 PID: 5995 Comm: cat Kdump: loaded Not tainted 6.12.0-rc6+ #3 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : pistrcmp+0x24/0x140 lr : zcompavailableshow+0x60/0x100 [zram] sp : ffff800088b93b90 x29: ffff800088b93b90 x28: 0000000000000001 x27: 0000000000400cc0 x26: 0000000000000ffe x25: ffff80007b3e2388 x24: 0000000000000000 x23: ffff80007b3e2390 x22: ffff0004041a9000 x21: ffff80007b3e2900 x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: ffff80007b3e2900 x9 : ffff80007b3cb280 x8 : 0101010101010101 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000040 x4 : 0000000000000000 x3 : 00656c722d6f7a6c x2 : 0000000000000000 x1 : ffff80007b3e2900 x0 : 0000000000000000 Call trace: pistrcmp+0x24/0x140 compalgorithmshow+0x40/0x70 [zram] devattrshow+0x28/0x80 sysfskfseqshow+0x90/0x140 kernfsseqshow+0x34/0x48 seqreaditer+0x1d4/0x4e8 kernfsfopreaditer+0x40/0x58 newsyncread+0x9c/0x168 vfsread+0x1a8/0x1f8 ksysread+0x74/0x108 arm64sysread+0x24/0x38 invokesyscall+0x50/0x120 el0svccommon.constprop.0+0xc8/0xf0 doel0svc+0x24/0x38 el0svc+0x38/0x138 el0t64synchandler+0xc0/0xc8 el0t64sync+0x188/0x190
The zram->compalgs[ZRAMPRIMARYCOMP] can be NULL in zramadd() if compalgorithmset() has not been called. User can access the zram device by sysfs after deviceadddisk(), so there is a time window to trigger the NULL pointer dereference. Move it ahead deviceadddisk() to make sure when user can access the zram device, it is ready. compalgorithmset() is protected by zram->initlock in other places and no such problem.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
zram: fix NULL pointer in compalgorithmshow()
LTP reported a NULL pointer dereference as followed:
CPU: 7 UID: 0 PID: 5995 Comm: cat Kdump: loaded Not tainted 6.12.0-rc6+ #3 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : pistrcmp+0x24/0x140 lr : zcompavailableshow+0x60/0x100 [zram] sp : ffff800088b93b90 x29: ffff800088b93b90 x28: 0000000000000001 x27: 0000000000400cc0 x26: 0000000000000ffe x25: ffff80007b3e2388 x24: 0000000000000000 x23: ffff80007b3e2390 x22: ffff0004041a9000 x21: ffff80007b3e2900 x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: ffff80007b3e2900 x9 : ffff80007b3cb280 x8 : 0101010101010101 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000040 x4 : 0000000000000000 x3 : 00656c722d6f7a6c x2 : 0000000000000000 x1 : ffff80007b3e2900 x0 : 0000000000000000 Call trace: pistrcmp+0x24/0x140 compalgorithmshow+0x40/0x70 [zram] devattrshow+0x28/0x80 sysfskfseqshow+0x90/0x140 kernfsseqshow+0x34/0x48 seqreaditer+0x1d4/0x4e8 kernfsfopreaditer+0x40/0x58 newsyncread+0x9c/0x168 vfsread+0x1a8/0x1f8 ksysread+0x74/0x108 arm64sysread+0x24/0x38 invokesyscall+0x50/0x120 el0svccommon.constprop.0+0xc8/0xf0 doel0svc+0x24/0x38 el0svc+0x38/0x138 el0t64synchandler+0xc0/0xc8 el0t64sync+0x188/0x190
The zram->compalgs[ZRAMPRIMARYCOMP] can be NULL in zramadd() if compalgorithmset() has not been called. User can access the zram device by sysfs after deviceadddisk(), so there is a time window to trigger the NULL pointer dereference. Move it ahead deviceadddisk() to make sure when user can access the zram device, it is ready. compalgorithmset() is protected by zram->initlock in other places and no such problem.
— NVD
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53222?
CVE-2024-53222 has been classified with a moderate severity due to the potential for a NULL pointer dereference leading to denial of service.
How do I fix CVE-2024-53222?
To fix CVE-2024-53222, update to a patched version of the Linux kernel that addresses the NULL pointer dereference issue.
Which versions of the Linux kernel are affected by CVE-2024-53222?
CVE-2024-53222 affects Linux kernel versions between 6.2 and 6.12.2.
What is the impact of CVE-2024-53222 on system stability?
The impact of CVE-2024-53222 can lead to system instability due to potential crashes or denial of service when the vulnerability is exploited.
Is there an official patch for CVE-2024-53222?
Yes, an official patch for CVE-2024-53222 has been released in the form of an updated kernel version that resolves the vulnerability.