一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 00:53:17

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

修复是否涉及abi变化(是/否)：

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

修复是否涉及abi变化(是/否)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

修复是否涉及abi变化(是/否)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

4.openEuler-22.03-LTS-SP1:

修复是否涉及abi变化(是/否)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

4.openEuler-22.03-LTS-SP1:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

4.openEuler-22.03-LTS-SP1:

修复是否涉及abi变化(是/否)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

4.openEuler-22.03-LTS-SP1:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

4.openEuler-22.03-LTS-SP1:

修复是否涉及abi变化(是/否)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

4.openEuler-22.03-LTS-SP1:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

4.openEuler-22.03-LTS-SP1:

修复是否涉及abi变化(是/否)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

4.openEuler-22.03-LTS-SP1:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

4.openEuler-22.03-LTS-SP1:

修复是否涉及abi变化(是/否)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

4.openEuler-22.03-LTS-SP1:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

4.openEuler-22.03-LTS-SP1:

修复是否涉及abi变化(是/否)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

4.openEuler-22.03-LTS-SP1:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

4.openEuler-22.03-LTS-SP1:

修复是否涉及abi变化(是/否)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

4.openEuler-22.03-LTS-SP1:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

4.openEuler-22.03-LTS-SP1:

修复是否涉及abi变化(是/否)：

1.openEuler-20.03-LTS-SP1(4.19.90):

2.openEuler-20.03-LTS-SP3(4.19.90):

3.openEuler-22.03-LTS:

4.openEuler-22.03-LTS-SP1:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

2.openEuler-22.03-LTS-SP1:

修复是否涉及abi变化(是/否)：

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

2.openEuler-22.03-LTS-SP1:

修复是否涉及abi变化(是/否)：

2.openEuler-22.03-LTS-SP1:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

2.openEuler-22.03-LTS-SP1:

修复是否涉及abi变化(是/否)：

2.openEuler-22.03-LTS-SP1:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

2.openEuler-22.03-LTS-SP1:

修复是否涉及abi变化(是/否)：

2.openEuler-22.03-LTS-SP1:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

2.openEuler-22.03-LTS-SP1:

修复是否涉及abi变化(是/否)：

2.openEuler-22.03-LTS-SP1:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

In Linux kernel v5.15 and up there is a NULL Pointer Dereference vulnerability in the NTFS3 driver in the function attr_punch_hole() in fs/ntfs3/attrib.c that could be triggered by any user.The NULL dereference is triggered every time a user tries to punch a hole in a sparse or compressed file.The vulnerability is indeed exploitable and reproducible.Environment:1. An environment with NTFS3 image mounted.2. NTFS3 image contains a sparse file or a compressed file.Reproducing:1. use `fallocate` with the option of `PUNCH_HOLE` (i.e. `fallocate -p -o 0 -l 5 mnt_point/to_punch`).2. NULL pointer dereference should be triggered.To summarize, a NULL pointer dereference vulnerability is in the NTFS3 driver, and can be used to create a DoS attack on a Linux machine.Reference:https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t

漏洞公开时间：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

2.openEuler-22.03-LTS-SP1:

修复是否涉及abi变化(是/否)：

2.openEuler-22.03-LTS-SP1:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

2.openEuler-22.03-LTS-SP1:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user could use this flaw to crash the system.

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user could use this flaw to crash the system.

漏洞公开时间：2023-01-13 03:15:00

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| nvd | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | |

| redhat | https://access.redhat.com/security/cve/CVE-2022-4842 | |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

2.openEuler-22.03-LTS-SP1:

3.openEuler-20.03-LTS-SP1(4.19.90):

4.openEuler-20.03-LTS-SP3(4.19.90):

5.openEuler-22.03-LTS:

修复是否涉及abi变化(是/否)：

2.openEuler-22.03-LTS-SP1:

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user could use this flaw to crash the system.

漏洞公开时间：2023-01-13 03:15:00

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| nvd | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | |

| redhat | https://access.redhat.com/security/cve/CVE-2022-4842 | |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user could use this flaw to crash the system.

漏洞公开时间：2023-01-13 03:15:00

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| nvd | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | |

| redhat | https://access.redhat.com/security/cve/CVE-2022-4842 | |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

No description is available for this CVE.

openEuler评分：

5.5

Vector：CVSS：2.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响)：

1.openEuler-22.03-LTS:受影响

2.openEuler-22.03-LTS-SP1:受影响

3.openEuler-20.03-LTS-SP1(4.19.90):不受影响

4.openEuler-20.03-LTS-SP3(4.19.90):不受影响

修复是否涉及abi变化(是/否)：

1.openEuler-22.03-LTS:否

2.openEuler-20.03-LTS-SP1(4.19.90):否

3.openEuler-20.03-LTS-SP3(4.19.90):否

4.openEuler-22.03-LTS-SP1:否

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.5

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user could use this flaw to crash the system.

漏洞公开时间：2023-01-13 03:15:00

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| nvd | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | |

| redhat | https://access.redhat.com/security/cve/CVE-2022-4842 | |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.5

Vector：CVSS：2.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响)：

1.openEuler-22.03-LTS:受影响

2.openEuler-22.03-LTS-SP1:受影响

3.openEuler-20.03-LTS-SP1(4.19.90):不受影响

4.openEuler-20.03-LTS-SP3(4.19.90):不受影响

修复是否涉及abi变化(是/否)：

1.openEuler-22.03-LTS:否

2.openEuler-20.03-LTS-SP1(4.19.90):否

3.openEuler-20.03-LTS-SP3(4.19.90):否

4.openEuler-22.03-LTS-SP1:否

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.5

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user could use this flaw to crash the system.

漏洞公开时间：2023-01-13 03:15:00

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| nvd | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | |

| redhat | https://access.redhat.com/security/cve/CVE-2022-4842 | |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.5

Vector：CVSS：2.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响)：

1.openEuler-22.03-LTS:受影响

2.openEuler-22.03-LTS-SP1:受影响

3.openEuler-20.03-LTS-SP1(4.19.90):不受影响

4.openEuler-20.03-LTS-SP3(4.19.90):不受影响

修复是否涉及abi变化(是/否)：

1.openEuler-22.03-LTS:否

2.openEuler-20.03-LTS-SP1(4.19.90):否

3.openEuler-20.03-LTS-SP3(4.19.90):否

4.openEuler-22.03-LTS-SP1:否

一、漏洞信息

漏洞编号：[CVE-2022-4842](https://nvd.nist.gov/vuln/detail/CVE-2022-4842)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.5

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user could use this flaw to crash the system.

漏洞公开时间：2023-01-13 03:15:00

漏洞创建时间：2022-12-30 15:40:09

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2022-4842

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| nvd | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | |

| redhat | https://access.redhat.com/security/cve/CVE-2022-4842 | |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4842 | https://bugzilla.suse.com/show_bug.cgi?id=1206749 |

| redhat_bugzilla | https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-4842 | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2156927 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-4842 | https://ubuntu.com/security/CVE-2022-4842 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2022-4842 |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.5

Vector：CVSS：2.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响)：

1.openEuler-22.03-LTS:受影响

2.openEuler-22.03-LTS-SP1:受影响

3.openEuler-20.03-LTS-SP1(4.19.90):不受影响

4.openEuler-20.03-LTS-SP3(4.19.90):不受影响

修复是否涉及abi变化(是/否)：

1.openEuler-22.03-LTS:否

2.openEuler-20.03-LTS-SP1(4.19.90):否

3.openEuler-20.03-LTS-SP3(4.19.90):否

4.openEuler-22.03-LTS-SP1:否