CVE-2022-50057

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fix NULL deref in ntfs_update_mftmirr

If ntfs_fill_super() wasn't called then sbi->sb will be equal to NULL.

Code should check this ptr before dereferencing. Syzbot hit this issue

via passing wrong mount param as can be seen from log below

Fail log:

ntfs3: Unknown parameter 'iochvrset'

general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN

KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]

CPU: 1 PID: 3589 Comm: syz-executor210 Not tainted 5.18.0-rc3-syzkaller-00016-gb253435746d9 #0

...

Call Trace:

<TASK>

put_ntfs+0x1ed/0x2a0 fs/ntfs3/super.c:463

ntfs_fs_free+0x6a/0xe0 fs/ntfs3/super.c:1363

put_fs_context+0x119/0x7a0 fs/fs_context.c:469

do_new_mount+0x2b4/0xad0 fs/namespace.c:3044

do_mount fs/namespace.c:3383 [inline]

__do_sys_mount fs/namespace.c:3591 [inline]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References