Null Pointer Dereference Vulnerability in Linux Kernel's I2C Mux Resource Handling

CVE-2022-50364

What is CVE-2022-50364?

A vulnerability in the Linux Kernel's I2C subsystem allows for potential null pointer dereferences due to improper handling of resource allocation. When the function platform_get_resource() returns NULL, subsequent calls to resource_size() may trigger crashes. To mitigate this issue, the code should ensure that resource_size() is invoked only after checking that the resource is valid. This can be achieved by utilizing the function devm_platform_get_and_ioremap_resource(), which simplifies the resource management process and includes appropriate checks to prevent this vulnerability.

References