In the Linux kernel, the following vulnerability has been resolved:
ext4: fix null-ptr-deref in ext4writeinfo
KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] CPU: 1 PID: 1589 Comm: umount Not tainted 5.10.0-02219-dirty #339 RIP: 0010:ext4writeinfo+0x53/0x1b0 [...] Call Trace: dquotwritebackdquots+0x341/0x9a0 ext4syncfs+0x19e/0x800 _syncfilesystem+0x83/0x100 syncfilesystem+0x89/0xf0 genericshutdownsuper+0x79/0x3e0 killblocksuper+0xa1/0x110 deactivatelockedsuper+0xac/0x130 deactivatesuper+0xb6/0xd0 cleanupmnt+0x289/0x400 _cleanupmnt+0x16/0x20 taskworkrun+0x11c/0x1c0 exittousermodeprepare+0x203/0x210 syscallexittousermode+0x5b/0x3a0 dosyscall64+0x59/0x70 entrySYSCALL64after_hwframe+0x44/0xa9 ==================================================================
exittousermodeprepare taskworkrun _cleanupmnt cleanupmnt deactivatesuper deactivatelockedsuper killblocksuper genericshutdownsuper shrinkdcacheforumount dentry = sb->sroot sb->sroot = NULL <--- Here set NULL syncfilesystem _syncfilesystem sb->sop->syncfs > ext4syncfs dquotwritebackdquots sb->dqop->writeinfo > ext4writeinfo ext4journalstart(dinode(sb->sroot), EXT4HTQUOTA, 2) dinode(sb->sroot) sroot->dinode <--- Null pointer dereference
To solve this problem, we use ext4journalstartsb directly to avoid sroot being used.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4b5ff0b794aa94afac7269c494550ca2f66511b",
"deprecated": false,
"digest": {
"function_hash": "296930575430671577123090474323976473232",
"length": 307.0
},
"target": {
"function": "ext4_write_info",
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-09dc90dc",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@947264e00c46de19a016fd81218118c708fed2f3",
"deprecated": false,
"digest": {
"function_hash": "296930575430671577123090474323976473232",
"length": 307.0
},
"target": {
"function": "ext4_write_info",
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-327c88b9",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@533c60a0b97cee5daab376933f486207e6680fb7",
"deprecated": false,
"digest": {
"function_hash": "296930575430671577123090474323976473232",
"length": 307.0
},
"target": {
"function": "ext4_write_info",
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-36a2fe0b",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bb420e8afc854d2a1caaa23a0c129839acfb7888",
"deprecated": false,
"digest": {
"function_hash": "296930575430671577123090474323976473232",
"length": 307.0
},
"target": {
"function": "ext4_write_info",
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-47389225",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4b5ff0b794aa94afac7269c494550ca2f66511b",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"37565987367529296846588713059413750300",
"185950489007676553008818687538213607526",
"230700317284483995288655053959167320618",
"96259271394206637476513920467350880185"
]
},
"target": {
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-4e34c4ec",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9c1f248607d5546075d3f731e7607d5571f2b60",
"deprecated": false,
"digest": {
"function_hash": "296930575430671577123090474323976473232",
"length": 307.0
},
"target": {
"function": "ext4_write_info",
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-562f0978",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@947264e00c46de19a016fd81218118c708fed2f3",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"37565987367529296846588713059413750300",
"185950489007676553008818687538213607526",
"230700317284483995288655053959167320618",
"96259271394206637476513920467350880185"
]
},
"target": {
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-698144ff",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3638aa1c7d87c0ca0aef23cf58cae2c48e7daca4",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"37565987367529296846588713059413750300",
"185950489007676553008818687538213607526",
"230700317284483995288655053959167320618",
"96259271394206637476513920467350880185"
]
},
"target": {
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-6c4ee7fb",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f34ab95162763cd7352f46df169296eec28b688d",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"37565987367529296846588713059413750300",
"185950489007676553008818687538213607526",
"230700317284483995288655053959167320618",
"96259271394206637476513920467350880185"
]
},
"target": {
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-6e500c4b",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a657319cfabd6199fd0b7b65bbebf6ded7a11c1",
"deprecated": false,
"digest": {
"function_hash": "296930575430671577123090474323976473232",
"length": 307.0
},
"target": {
"function": "ext4_write_info",
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-73a2d628",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a657319cfabd6199fd0b7b65bbebf6ded7a11c1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"37565987367529296846588713059413750300",
"185950489007676553008818687538213607526",
"230700317284483995288655053959167320618",
"96259271394206637476513920467350880185"
]
},
"target": {
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-740b9e0e",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bb420e8afc854d2a1caaa23a0c129839acfb7888",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"37565987367529296846588713059413750300",
"185950489007676553008818687538213607526",
"230700317284483995288655053959167320618",
"96259271394206637476513920467350880185"
]
},
"target": {
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-883c40a5",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@533c60a0b97cee5daab376933f486207e6680fb7",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"37565987367529296846588713059413750300",
"185950489007676553008818687538213607526",
"230700317284483995288655053959167320618",
"96259271394206637476513920467350880185"
]
},
"target": {
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-9d02845d",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3638aa1c7d87c0ca0aef23cf58cae2c48e7daca4",
"deprecated": false,
"digest": {
"function_hash": "296930575430671577123090474323976473232",
"length": 307.0
},
"target": {
"function": "ext4_write_info",
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-a38291dc",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc451578446afd03c0c21913993c08898a691435",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"37565987367529296846588713059413750300",
"185950489007676553008818687538213607526",
"230700317284483995288655053959167320618",
"96259271394206637476513920467350880185"
]
},
"target": {
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-b2723196",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc451578446afd03c0c21913993c08898a691435",
"deprecated": false,
"digest": {
"function_hash": "296930575430671577123090474323976473232",
"length": 307.0
},
"target": {
"function": "ext4_write_info",
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-bb4132b9",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f34ab95162763cd7352f46df169296eec28b688d",
"deprecated": false,
"digest": {
"function_hash": "296930575430671577123090474323976473232",
"length": 307.0
},
"target": {
"function": "ext4_write_info",
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-c0b7ed14",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9c1f248607d5546075d3f731e7607d5571f2b60",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"37565987367529296846588713059413750300",
"185950489007676553008818687538213607526",
"230700317284483995288655053959167320618",
"96259271394206637476513920467350880185"
]
},
"target": {
"file": "fs/ext4/super.c"
},
"id": "CVE-2022-50344-d79f042f",
"signature_version": "v1",
"signature_type": "Line"
}
]