CVE-2022-49947

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

binder: fix alloc->vma_vm_mm null-ptr dereference

Syzbot reported a couple issues introduced by commit 44e602b4e52f

("binder_alloc: add missing mmap_lock calls when using the VMA"), in

which we attempt to acquire the mmap_lock when alloc->vma_vm_mm has not

been initialized yet.

This can happen if a binder_proc receives a transaction without having

previously called mmap() to setup the binder_proc->alloc space in [1].

Also, a similar issue occurs via binder_alloc_print_pages() when we try

to dump the debugfs binder stats file in [2].

Sample of syzbot's crash report:

==================================================================

KASAN: null-ptr-deref in range [0x0000000000000128-0x000000000000012f]

CPU: 0 PID: 3755 Comm: syz-executor229 Not tainted 6.0.0-rc1-next-20220819-syzkaller #0

syz-executor229[3755] cmdline: ./syz-executor2294415195

Hardware name: Google Google Compute Engine/Google Compute Engin

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References