Linux Kernel Bio-Integrity Null Pointer Dereference Vulnerability

A null pointer dereference vulnerability has been identified in the Linux kernel's bio-integrity handling. This issue arises in the 'bio_integrity_map_user()' function, which fails to properly manage partial page pinning. The 'pin_user_pages_fast()' function can return a count of successfully pinned pages, but the bio-integrity function does not account for this, leading to a general protection fault. The fault occurs because 'bvec_from_pages()' tries to access an unpinned page, resulting in a crash. The vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability leads to a general protection fault, causing a crash by dereferencing a null pointer, which is interpreted as a non-canonical address.

Reproduction

The vulnerability can be reproduced by using the 'bio_integrity_map_user()' function with an 'iov_iter' that represents user-backed data. If 'pin_user_pages_fast()' returns fewer pinned pages than requested, the function will dereference an unpinned page, causing a null pointer dereference.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.