CVE-2022-50336

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Add null pointer check to attr_load_runs_vcn

Some metadata files are handled before MFT. This adds a null pointer

check for some corner cases that could lead to NPD while reading these

metadata files for a malformed NTFS image.

[ 240.190827] BUG: kernel NULL pointer dereference, address: 0000000000000158

[ 240.191583] #PF: supervisor read access in kernel mode

[ 240.191956] #PF: error_code(0x0000) - not-present page

[ 240.192391] PGD 0 P4D 0

[ 240.192897] Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI

[ 240.193805] CPU: 0 PID: 242 Comm: mount Tainted: G B 5.19.0+ #17

[ 240.194477] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014

[ 240.195152] RIP: 0010:ni_find_attr+0xae/0x300

[ 240.195679] Code: c8 48 c7 45 88 c0 4e 5e 86 c7 00 f1 f1 f1 f1 c7 40 04 00 f3 f3 f3 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 e2 d9f

[ 240.19

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References