In the Linux kernel, the following vulnerability has been resolved:
nfs: fix possible null-ptr-deref when parsing param
According to commit "vfs: parse: deal with zero length string value", kernel will set the param->string to null pointer in vfsparsefs_string() if fs string has zero length.
Yet the problem is that, nfsfscontextparseparam() will dereferences the param->string, without checking whether it is a null pointer, which may trigger a null-ptr-deref bug.
This patch solves it by adding sanity check on param->string in nfsfscontextparseparam().
[
{
"digest": {
"function_hash": "86971402455087801453316350680115358047",
"length": 9182.0
},
"id": "CVE-2022-50455-00606bd3",
"target": {
"function": "nfs_fs_context_parse_param",
"file": "fs/nfs/fs_context.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55513864b418c6453d68aebc36cffcf965342426",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"214828934197391809563247119320429599031",
"131900938136163007619418368867239978270",
"38771395092654510681981708534894095771",
"301478637442451085658276444835820504947",
"84720436972221618497246035462000507431",
"84173747775742688465394415143746222642",
"296306538131571124319934219829125668900",
"293578954049881351795327341342985220144",
"179863107122444739269315893431591370799",
"334870095796375890766825391742462171771",
"228424301908732431203060901910201686909",
"81656042360220431392217785971287149257"
],
"threshold": 0.9
},
"id": "CVE-2022-50455-1e54c47e",
"target": {
"file": "fs/nfs/fs_context.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55513864b418c6453d68aebc36cffcf965342426",
"signature_type": "Line"
},
{
"digest": {
"function_hash": "86971402455087801453316350680115358047",
"length": 9182.0
},
"id": "CVE-2022-50455-474b4991",
"target": {
"function": "nfs_fs_context_parse_param",
"file": "fs/nfs/fs_context.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5559405df652008e56eee88872126fe4c451da67",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"214828934197391809563247119320429599031",
"131900938136163007619418368867239978270",
"38771395092654510681981708534894095771",
"301478637442451085658276444835820504947",
"84720436972221618497246035462000507431",
"84173747775742688465394415143746222642",
"296306538131571124319934219829125668900",
"293578954049881351795327341342985220144",
"179863107122444739269315893431591370799",
"334870095796375890766825391742462171771",
"228424301908732431203060901910201686909",
"81656042360220431392217785971287149257"
],
"threshold": 0.9
},
"id": "CVE-2022-50455-4ae38f5b",
"target": {
"file": "fs/nfs/fs_context.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5559405df652008e56eee88872126fe4c451da67",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"214828934197391809563247119320429599031",
"131900938136163007619418368867239978270",
"38771395092654510681981708534894095771",
"301478637442451085658276444835820504947",
"84720436972221618497246035462000507431",
"84173747775742688465394415143746222642",
"296306538131571124319934219829125668900",
"293578954049881351795327341342985220144",
"179863107122444739269315893431591370799",
"334870095796375890766825391742462171771",
"228424301908732431203060901910201686909",
"81656042360220431392217785971287149257"
],
"threshold": 0.9
},
"id": "CVE-2022-50455-773b1b90",
"target": {
"file": "fs/nfs/fs_context.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46819f604557fe7bc39a6c352fd368371aa9cd6e",
"signature_type": "Line"
},
{
"digest": {
"function_hash": "86971402455087801453316350680115358047",
"length": 9182.0
},
"id": "CVE-2022-50455-9ef63d0e",
"target": {
"function": "nfs_fs_context_parse_param",
"file": "fs/nfs/fs_context.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46819f604557fe7bc39a6c352fd368371aa9cd6e",
"signature_type": "Function"
}
]