CVE-2022-0419: 
NixOS vulnerability analysis and mitigation

CVE-2022-0419 is a NULL Pointer Dereference vulnerability discovered in the radare2 reverse engineering framework, affecting versions prior to 5.6.0. The vulnerability was identified by Angelos T. Kalaitzidis of CENSUS and was disclosed in December 2021 (Census Labs, OSS Security).

The vulnerability exists in the loadbuffer function of radare2/libr/bin/p/binxnukernelcache.c. When the getprelinkinforangefrommach0() function fails and returns NULL, the obj pointer remains uninitialized. Subsequently, an attempt to access obj->cache_buf results in a NULL pointer dereference and program crash (Census Labs).

When exploited, this vulnerability can cause the radare2 program to crash when processing a specially crafted binary file, potentially leading to denial of service (Census Labs).

The vulnerability was patched in radare2 version 5.6.0. Users are advised to upgrade to version 5.6.0 or later to remediate this issue. The fix involves adding a NULL pointer check before accessing the obj pointer (GitHub Commit, Census Labs).

The vulnerability was addressed promptly by the upstream project in February 2022, and various Linux distributions including Fedora subsequently released security updates to address this issue (Fedora Update).