CVE-2022-50057

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-50057
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix NULL deref in ntfs_update_mftmirr If ntfs_fill_super() wasn't called then sbi->sb will be equal to NULL. Code should check this ptr before dereferencing. Syzbot hit this issue via passing wrong mount param as can be seen from log below Fail log: ntfs3: Unknown parameter 'iochvrset' general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] CPU: 1 PID: 3589 Comm: syz-executor210 Not tainted 5.18.0-rc3-syzkaller-00016-gb253435746d9 #0 ... Call Trace: <TASK> put_ntfs+0x1ed/0x2a0 fs/ntfs3/super.c:463 ntfs_fs_free+0x6a/0xe0 fs/ntfs3/super.c:1363 put_fs_context+0x119/0x7a0 fs/fs_context.c:469 do_new_mount+0x2b4/0xad0 fs/namespace.c:3044 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline]

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/321460ca3b55f48b3ba6008248264ab2bd6407d9 Patch
https://git.kernel.org/stable/c/8e8e1a84dac7a3d2b432162a70d7fb6a75960772 Patch
https://git.kernel.org/stable/c/bf6089dc01ba3194ab962105d7b85690843c256f Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*
History

13 Nov 2025, 18:06

Type Values Removed Values Added
CWE CWE-476
References () https://git.kernel.org/stable/c/321460ca3b55f48b3ba6008248264ab2bd6407d9 - () https://git.kernel.org/stable/c/321460ca3b55f48b3ba6008248264ab2bd6407d9 - Patch
References () https://git.kernel.org/stable/c/8e8e1a84dac7a3d2b432162a70d7fb6a75960772 - () https://git.kernel.org/stable/c/8e8e1a84dac7a3d2b432162a70d7fb6a75960772 - Patch
References () https://git.kernel.org/stable/c/bf6089dc01ba3194ab962105d7b85690843c256f - () https://git.kernel.org/stable/c/bf6089dc01ba3194ab962105d7b85690843c256f - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/ntfs3: Se corrige la desreferenciación NULL en ntfs_update_mftmirr. Si no se invocó ntfs_fill_super(), sbi-&gt;sb será igual a NULL. El código debe comprobar este ptr antes de desreferenciar. Syzbot encontró este problema al pasar un parámetro de montaje incorrecto como se puede ver en el registro a continuación. Registro de errores: ntfs3: Error de protección general del parámetro desconocido 'iochvrset', probablemente para una dirección no canónica 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref en el rango [0x000000000000018-0x000000000000001f] CPU: 1 PID: 3589 Comm: syz-executor210 No contaminado 5.18.0-rc3-syzkaller-00016-gb253435746d9 #0 ... Rastreo de llamadas: put_ntfs+0x1ed/0x2a0 fs/ntfs3/super.c:463 ntfs_fs_free+0x6a/0xe0 fs/ntfs3/super.c:1363 put_fs_context+0x119/0x7a0 fs/fs_context.c:469 do_new_mount+0x2b4/0xad0 fs/namespace.c:3044 do_mount fs/namespace.c:3383 [en línea] __do_sys_mount fs/namespace.c:3591 [en línea]

18 Jun 2025, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-18 11:15

Updated : 2025-11-13 18:06

NVD link : CVE-2022-50057

Mitre link : CVE-2022-50057

CVE.ORG link : CVE-2022-50057

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference