Linux Kernel Tracing NULL Pointer Dereference Vulnerability in hist_field_name Function

A vulnerability in the Linux kernel's tracing subsystem can lead to a NULL pointer dereference. This issue arises in the hist_field_name() function, which is responsible for returning the name of a histogram field. The vulnerability occurs when the function processes fully-qualified VAR_REF/EXPR cases. In these instances, if a variable name is too long, it can cause a buffer overflow, leading to a NULL return that bypasses a safeguard. This unexpected NULL value is then dereferenced by callers, causing a crash. The vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability leads to a NULL pointer dereference, causing a system crash.

Reproduction

The vulnerability can be reproduced by creating a histogram variable name that exceeds the length limit and is referenced in a fully-qualified VAR_REF/EXPR context. This will trigger the snprintf() truncation, causing hist_field_name() to return NULL, which can then be dereferenced by the tracing subsystem, leading to a crash.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.