In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: fix NULL pointer dereference in virtiogpuconngetmodes
drmcvtmode may return NULL and we should check it.
This bug is found by syzkaller:
FAULTINJECTION stacktrace: [ 168.567394] FAULTINJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 [ 168.567403] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567406] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567408] Call trace: [ 168.567414] dumpbacktrace+0x0/0x310 [ 168.567418] showstack+0x28/0x38 [ 168.567423] dumpstack+0xec/0x15c [ 168.567427] shouldfail+0x3ac/0x3d0 [ 168.567437] _shouldfailslab+0xb8/0x120 [ 168.567441] shouldfailslab+0x28/0xc0 [ 168.567445] kmemcachealloctrace+0x50/0x640 [ 168.567454] drmmodecreate+0x40/0x90 [ 168.567458] drmcvtmode+0x48/0xc78 [ 168.567477] virtiogpuconngetmodes+0xa8/0x140 [virtiogpu] [ 168.567485] drmhelperprobesingleconnectormodes+0x3a4/0xd80 [ 168.567492] drmmodegetconnector+0x2e0/0xa70 [ 168.567496] drmioctlkernel+0x11c/0x1d8 [ 168.567514] drmioctl+0x558/0x6d0 [ 168.567522] dovfsioctl+0x160/0xf30 [ 168.567525] ksysioctl+0x98/0xd8 [ 168.567530] _arm64sysioctl+0x50/0xc8 [ 168.567536] el0svccommon+0xc8/0x320 [ 168.567540] el0svchandler+0xf8/0x160 [ 168.567544] el0svc+0x10/0x218
KASAN stacktrace: [ 168.567561] BUG: KASAN: null-ptr-deref in virtiogpuconngetmodes+0xb4/0x140 [virtiogpu] [ 168.567565] Read of size 4 at addr 0000000000000054 by task syz/6425 [ 168.567566] [ 168.567571] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567573] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567575] Call trace: [ 168.567578] dumpbacktrace+0x0/0x310 [ 168.567582] showstack+0x28/0x38 [ 168.567586] dumpstack+0xec/0x15c [ 168.567591] kasanreport+0x244/0x2f0 [ 168.567594] _asanload4+0x58/0xb0 [ 168.567607] virtiogpuconngetmodes+0xb4/0x140 [virtiogpu] [ 168.567612] drmhelperprobesingleconnectormodes+0x3a4/0xd80 [ 168.567617] drmmodegetconnector+0x2e0/0xa70 [ 168.567621] drmioctlkernel+0x11c/0x1d8 [ 168.567624] drmioctl+0x558/0x6d0 [ 168.567628] dovfsioctl+0x160/0xf30 [ 168.567632] ksysioctl+0x98/0xd8 [ 168.567636] _arm64sysioctl+0x50/0xc8 [ 168.567641] el0svccommon+0xc8/0x320 [ 168.567645] el0svchandler+0xf8/0x160 [ 168.567649] el0_svc+0x10/0x218
[
{
"id": "CVE-2022-49532-03a550a4",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 588.0,
"function_hash": "165001877776892022010861453707247005056"
},
"target": {
"function": "virtio_gpu_conn_get_modes",
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0828456578cc8ba0a69147f7ae3428392eec287"
},
{
"id": "CVE-2022-49532-07a1d015",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"59391145829676287408861130092381991468",
"330433197487900957014733486043739762405",
"2416233606295970040097597581256995975",
"229820085278974030457654562349023789844"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0828456578cc8ba0a69147f7ae3428392eec287"
},
{
"id": "CVE-2022-49532-1a77d6bc",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"59391145829676287408861130092381991468",
"330433197487900957014733486043739762405",
"2416233606295970040097597581256995975",
"229820085278974030457654562349023789844"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@edafcad84c4134ebec4bc24b29ca4497a1184eea"
},
{
"id": "CVE-2022-49532-1cc7c564",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 642.0,
"function_hash": "252100210303843896088572622498180835092"
},
"target": {
"function": "virtio_gpu_conn_get_modes",
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@32e10aabc287f09a148ff759bb9ce70b01b0012c"
},
{
"id": "CVE-2022-49532-33c17c08",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 588.0,
"function_hash": "165001877776892022010861453707247005056"
},
"target": {
"function": "virtio_gpu_conn_get_modes",
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@edafcad84c4134ebec4bc24b29ca4497a1184eea"
},
{
"id": "CVE-2022-49532-352b6b89",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"59391145829676287408861130092381991468",
"330433197487900957014733486043739762405",
"2416233606295970040097597581256995975",
"229820085278974030457654562349023789844"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f8bc147a963686b7351aa35d1701124ffacac08"
},
{
"id": "CVE-2022-49532-35aae5d3",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 642.0,
"function_hash": "252100210303843896088572622498180835092"
},
"target": {
"function": "virtio_gpu_conn_get_modes",
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@194d250cdc4a40ccbd179afd522a9e9846957402"
},
{
"id": "CVE-2022-49532-41151744",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 588.0,
"function_hash": "165001877776892022010861453707247005056"
},
"target": {
"function": "virtio_gpu_conn_get_modes",
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@848dd072744ea662ab3097e3c8282bee552df218"
},
{
"id": "CVE-2022-49532-532b1020",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 642.0,
"function_hash": "252100210303843896088572622498180835092"
},
"target": {
"function": "virtio_gpu_conn_get_modes",
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c51d00472fa54b9b05c17789ed665c17adf3a25d"
},
{
"id": "CVE-2022-49532-554974a5",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"59391145829676287408861130092381991468",
"330433197487900957014733486043739762405",
"2416233606295970040097597581256995975",
"229820085278974030457654562349023789844"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadc626cae99aaa1325094edc6a9e2b883f3e562"
},
{
"id": "CVE-2022-49532-614dcb4c",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"59391145829676287408861130092381991468",
"330433197487900957014733486043739762405",
"2416233606295970040097597581256995975",
"229820085278974030457654562349023789844"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@848dd072744ea662ab3097e3c8282bee552df218"
},
{
"id": "CVE-2022-49532-72340a91",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"59391145829676287408861130092381991468",
"330433197487900957014733486043739762405",
"2416233606295970040097597581256995975",
"229820085278974030457654562349023789844"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f85cb059fad03a3b33a50023be91e944bb065ae8"
},
{
"id": "CVE-2022-49532-7b076ce0",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"59391145829676287408861130092381991468",
"330433197487900957014733486043739762405",
"2416233606295970040097597581256995975",
"229820085278974030457654562349023789844"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@32e10aabc287f09a148ff759bb9ce70b01b0012c"
},
{
"id": "CVE-2022-49532-7d139779",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 676.0,
"function_hash": "114744222806323877343266124389392307769"
},
"target": {
"function": "virtio_gpu_conn_get_modes",
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f85cb059fad03a3b33a50023be91e944bb065ae8"
},
{
"id": "CVE-2022-49532-827f9aac",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"59391145829676287408861130092381991468",
"330433197487900957014733486043739762405",
"2416233606295970040097597581256995975",
"229820085278974030457654562349023789844"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@194d250cdc4a40ccbd179afd522a9e9846957402"
},
{
"id": "CVE-2022-49532-9e587703",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"59391145829676287408861130092381991468",
"330433197487900957014733486043739762405",
"2416233606295970040097597581256995975",
"229820085278974030457654562349023789844"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c51d00472fa54b9b05c17789ed665c17adf3a25d"
},
{
"id": "CVE-2022-49532-aa905457",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 642.0,
"function_hash": "252100210303843896088572622498180835092"
},
"target": {
"function": "virtio_gpu_conn_get_modes",
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fadc626cae99aaa1325094edc6a9e2b883f3e562"
},
{
"id": "CVE-2022-49532-d5cea28f",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 642.0,
"function_hash": "252100210303843896088572622498180835092"
},
"target": {
"function": "virtio_gpu_conn_get_modes",
"file": "drivers/gpu/drm/virtio/virtgpu_display.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f8bc147a963686b7351aa35d1701124ffacac08"
}
]