Null pointer dereference occurs when a program attempts to read or write memory via a pointer that has been set to NULL (0x0). In user-space applications, null dereference typically causes a segmentation fault (SIGSEGV) → denial of service (DoS). However, in kernel-space (drivers, syscalls), null pointer dereference can lead to privilege escalation (user → root). Attackers exploit kernel null dereference by mapping the NULL page (mmap at 0x0) with malicious data (function pointers, vtable). 15% of kernel vulnerabilities are null pointer dereferences (CVE database).
Null Pointer Statistics: 15% of kernel vulnerabilities are null pointer dereferences. 60% of kernel null dereferences lead to privilege escalation. Android kernel NULL pointer (CVE-2020-0041) affected 1B+ devices.
Common null pointer dereference targets:
Application dereferences NULL pointer → segmentation fault → crash. Denial of service (DoS) only. No code execution (SMAP/SMEP prevent kernel null page mapping in user space).
Kernel dereferences NULL pointer (driver, syscall). Attacker maps NULL page (mmap at 0x0) with fake vtable. Kernel reads attacker-controlled memory → RCE/privilege escalation.
Attacker uses mmap(MAP_FIXED) to map page at 0x0. Kernel null dereference reads attacker-controlled NULL page → privilege escalation.
// Kernel NULL pointer dereference exploit (Android CVE-2020-0041)
// 1. Vulnerable kernel driver (NULL pointer dereference)
static long vulnerable_ioctl(struct file *file, unsigned int cmd, unsigned long arg) {
struct device *dev = NULL; // dev is NULL
// Later in function: NULL pointer dereference
dev->ops->open(dev); // Oops! NULL dereference
return 0;
}
// 2. Attacker maps NULL page in user space
int fd = open("/dev/vulnerable", O_RDWR);
void *null_page = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
// mmap at address 0x0 (NULL page)
// 3. Craft fake vtable at offset 0x0
struct fake_vtable {
void *open_ptr;
void *release_ptr;
void *read_ptr;
};
struct fake_vtable vtable;
vtable.open_ptr = shellcode_address; // Point to user-space shellcode
memcpy(null_page, &vtable, sizeof(vtable));
// 4. Trigger kernel NULL pointer dereference
ioctl(fd, 0, 0);
// Kernel reads NULL page (now attacker-controlled) → executes shellcode
// Privilege escalation: user → root
NULL pointer dereference in Android kernel (Qualcomm GPU driver). Privilege escalation (user → root). Affected 1 billion+ Android devices (Android 8, 9, 10). Exploited in the wild.
NULL pointer dereference in Linux kernel (mremap syscall). Local privilege escalation (user → root). Affected kernels 4.8-5.7.
Win32k NULL pointer dereference. Local privilege escalation (user → SYSTEM). Affected Windows 7, 8.1, 10.
iOS kernel NULL pointer dereference. Attacker mapped NULL page → privilege escalation. Jailbreak exploit.
// Null pointer dereference statistics (2023-2024)
- 15% of kernel vulnerabilities are null pointer dereferences
- 60% of kernel null dereferences lead to privilege escalation (user → root)
- 40% lead to denial of service (DoS)
- 70% of null pointer dereferences occur in kernel drivers (video, GPU, network, USB)
- 20% occur in syscalls
- 10% occur in filesystem code
- Android kernel NULL pointer (CVE-2020-0041) affected 1B+ devices
- Average CVSS score: 7.8 (High)
// Most affected kernel components
1. GPU drivers (Qualcomm, Mali, Adreno): 35%
2. USB drivers: 25%
3. Network drivers: 20%
4. Filesystem (FUSE, ext4): 10%
5. Syscalls (mremap, ioctl): 10%
This demonstration simulates kernel NULL pointer dereference leading to privilege escalation:
This is a simulated demonstration. Real kernel NULL pointer dereferences (Android CVE-2020-0041) allow privilege escalation via NULL page mapping. Defenses: Always check pointers before dereference (if (ptr == NULL) return -EINVAL). Use __attribute__((nonnull)) for function arguments. Enable CONFIG_USERFAULTFD (Linux). Use SMAP/SMEP (kernel). Enable UBSAN (nullability).
Detects potential NULL pointer dereference (pointer used after NULL check). Flags dereferences without prior NULL check.
Detects NULL pointer dereference at runtime (ubsan -fsanitize=null). Reports null-dereference errors.
Detects kernel NULL pointer dereference (KASAN). Reports null-deref with stack trace.
Check if (ptr == NULL) return -EINVAL; before dereferencing. Never assume pointer is valid.
Mark function arguments that must not be NULL. Compiler warns if NULL passed.
Linux kernel disables mapping NULL page by default (CONFIG_USERFAULTFD). Prevents NULL page mapping attacks.
Static analysis detects NULL pointer dereference vulnerabilities during development.
Best Practice - Always Check Pointers + Static Analysis: Always check pointers for NULL before dereference (if (ptr == NULL) return -EINVAL). Use __attribute__((nonnull)) for function arguments. Enable static analysis (Clang Static Analyzer, Coverity). Enable UBSAN nullability (-fsanitize=null). For kernel, enable CONFIG_USERFAULTFD to prevent NULL page mapping. Use SMAP/SMEP to prevent kernel NULL page access.
Null pointer dereference exploitation is illegal when used without authorization (CFAA). Ethical uses include:
Null pointer dereference exploits are illegal when used without authorization. Penalties include:
Important: This guide is for educational and defensive purposes only. Only test null pointer dereference vulnerabilities on systems you own or have explicit written authorization. Responsible disclosure to vendors.
Technical analysis of Android kernel NULL pointer dereference exploit.
Kernel configuration to prevent NULL page mapping attacks.
Static analysis for detecting null pointer dereference vulnerabilities.