Linux Kernel Hugetlbfs Null Pointer Dereference Vulnerability

A null pointer dereference vulnerability has been identified in the Linux kernel's hugetlbfs file system. This issue arises in the hugetlbfs_parse_param function, where the code improperly dereferences a parameter string without checking if it is null. The vulnerability can be triggered by passing an illegal mount parameter, such as 'size=,'. This flaw was reported by Syzkaller and is present in the stable versions of the Linux kernel.

Impact

Exploitation of this vulnerability leads to a null pointer dereference, causing a kernel crash.

Reproduction

The vulnerability can be reproduced by mounting a hugetlbfs file system with an invalid parameter that results in a null pointer being passed to the hugetlbfs_parse_param function. This can be done by using the 'size=,' parameter, which creates a null pointer in the fs_parameter structure. When this structure is processed by the hugetlbfs_parse_param function, it triggers the null pointer dereference.

Remediation

Users can upgrade to the latest stable version of the Linux kernel, where this vulnerability has been patched.