firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle (Linux Linux)

CVE-2023-53250
MEDIUM 5.5

En bref

Source
NVD
EPSS
EPSS 0.15 % · centile 4 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Modified

Description

In the Linux kernel, the following vulnerability has been resolved: firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle KASAN reported a null-ptr-deref error: KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 1373 Comm: modprobe Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:dmi_sysfs_entry_release ... Call Trace: <TASK> kobject_put dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs dmi_decode_table (drivers/firmware/dmi_scan.c:133) dmi_walk (drivers/firmware/dmi_scan.c:1115) dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs do_one_initcall (init/main.c:1296) ... Kernel panic - not syncing: Fatal exception Kernel Offset: 0x4000000 from 0xffffffff81000000 ---[ end Kernel panic - not syncing: Fatal exception ]--- It is because previous patch added kobject_put() to release the memory which will call dmi_sysfs_entry_release() and list_del(). However, list_add_tail(entry->list) is called after the error block, so the list_head is uninitialized and cannot be deleted. Move error handling to after list_add_tail to fix this.

Faiblesses (CWE)

  • CWE-476 — Déréférencement de pointeur nul

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Linux · Linuxaffected fdffa4ad8f6bf1ece877edfb807f2b2c729d8578 < b4fe158259fb5fead52ff2b55841ec5c39492604 ; affected 660ba678f9998aca6db74f2dd912fa5124f0fa31 < e851996b32264e78a10863c2ac41a8689d7b9252 ; affected 660ba678f9998aca6db74f2dd912fa5124f0fa31 < 5d0492d1d934642bdfd2057acc1b56f4b57be465 ; affected 660ba678f9998aca6db74f2dd912fa5124f0fa31 < 18e126e97c961f7a93823795c879d7c085fe5098 ; affected a9bfb37d6ba7c376b0d53337a4c5f5ff324bd725 ; affected ed38d04342dfbe9e5aca745c8b5eb4188a74f0ef
Linux · Linuxaffected 5.19 ; unaffected 0 < 5.19 ; unaffected 5.15.99 ≤ 5.15.* ; unaffected 6.1.16 ≤ 6.1.* ; unaffected 6.2.3 ≤ 6.2.* ; unaffected 6.3 ≤ *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD