CVE-2022-50334

published 2025-09-15

CVE-2022-50334: In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() Syzkaller reports a null-ptr-deref…

Priority P4 19 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()

Syzkaller reports a null-ptr-deref bug as follows:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:hugetlbfs_parse_param+0x1dd/0x8e0 fs/hugetlbfs/inode.c:1380
[...]
Call Trace:

vfs_parse_fs_param fs/fs_context.c:148 [inline]
vfs_parse_fs_param+0x1f9/0x3c0 fs/fs_context.c:129
vfs_parse_fs_string+0xdb/0x170 fs/fs_context.c:191
generic_parse_monolithic+0x16f/0x1f0 fs/fs_context.c:231
do_new_mount fs/namespace.c:3036 [inline]
path_mount+0x12de/0x1e20 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__x64_sys_mount+0x27f/0x300 fs/namespace.c:3568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
[...]

According to commit "vfs: parse: deal with zero length string value",
kernel will set the param->string to null pointer in vfs_parse_fs_string()
if fs string has zero length.

Yet the problem is that, hugetlbfs_parse_param() will dereference the
param->string, without checking whether it is a null pointer. To be more
specific, if hugetlbfs_parse_param() parses an illegal mount parameter,
such as "size=,", kernel will constructs struct fs_parameter with null
pointer in vfs_parse_fs_string(), then passes this struct fs_parameter to
hugetlbfs_parse_param(), which triggers the above null-ptr-deref bug.

This patch solves it by adding sanity check on param->string
in hugetlbfs_parse_param().

Affected

17 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.4-1 (bookworm)	linux 6.1.4-1 (bookworm)
linux	linux	—	—
linux	linux	>= 32021982a324dce93b4ae00c06213bf45fb319c8 < fa71639873518e3587632ae58e25e4a96b57fa90	fa71639873518e3587632ae58e25e4a96b57fa90
linux	linux	>= 32021982a324dce93b4ae00c06213bf45fb319c8 < dcd28191be9bbf307ba51a5b485773a55b0037c4	dcd28191be9bbf307ba51a5b485773a55b0037c4
linux	linux	>= 32021982a324dce93b4ae00c06213bf45fb319c8 < 9a8862820cbf1f18dca4f3b4c289d88561b3a384	9a8862820cbf1f18dca4f3b4c289d88561b3a384
linux	linux	>= 32021982a324dce93b4ae00c06213bf45fb319c8 < 965e8f8ae0f642b5528f5a82b7bcaf15a659d5bd	965e8f8ae0f642b5528f5a82b7bcaf15a659d5bd
linux	linux	>= 32021982a324dce93b4ae00c06213bf45fb319c8 < f2207145693ae5697a7b59e2add4b92f9e5b0e3c	f2207145693ae5697a7b59e2add4b92f9e5b0e3c
linux	linux	>= 32021982a324dce93b4ae00c06213bf45fb319c8 < 26215b7ee923b9251f7bb12c4e5f09dc465d35f2	26215b7ee923b9251f7bb12c4e5f09dc465d35f2
linux	linux_kernel	< 5.4.229	5.4.229
linux	linux_kernel	>= 0 < 5.10.178-1	5.10.178-1
linux	linux_kernel	>= 0 < 6.1.4-1	6.1.4-1
linux	linux_kernel	>= 0 < 6.1.4-1	6.1.4-1
linux	linux_kernel	>= 0 < 6.1.4-1	6.1.4-1
linux	linux_kernel	>= 5.11 < 5.15.86	5.15.86
linux	linux_kernel	>= 5.16 < 6.0.16	6.0.16
linux	linux_kernel	>= 5.5 < 5.10.163	5.10.163
linux	linux_kernel	>= 6.1 < 6.1.2	6.1.2

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-476