firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.15 % · centile 4 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle KASAN reported a null-ptr-deref error: KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 1373 Comm: modprobe Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:dmi_sysfs_entry_release ... Call Trace: <TASK> kobject_put dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs dmi_decode_table (drivers/firmware/dmi_scan.c:133) dmi_walk (drivers/firmware/dmi_scan.c:1115) dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs do_one_initcall (init/main.c:1296) ... Kernel panic - not syncing: Fatal exception Kernel Offset: 0x4000000 from 0xffffffff81000000 ---[ end Kernel panic - not syncing: Fatal exception ]--- It is because previous patch added kobject_put() to release the memory which will call dmi_sysfs_entry_release() and list_del(). However, list_add_tail(entry->list) is called after the error block, so the list_head is uninitialized and cannot be deleted. Move error handling to after list_add_tail to fix this.
Faiblesses (CWE)
- CWE-476 — Déréférencement de pointeur nul
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2023-59834
- GCVE · GCVE-0-2023-53250
Avis du CERT-FR
- CERTFR-2025-AVI-0921 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0895 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.9.318 < 4.10cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.14.283 < 4.15cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.19.247 < 4.20cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.198 < 5.5cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10.122 < 5.11cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.47 < 5.15.99cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.17.15 < 5.18cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.18.4 < 6.1.16cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.2.3
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected fdffa4ad8f6bf1ece877edfb807f2b2c729d8578 < b4fe158259fb5fead52ff2b55841ec5c39492604 ; affected 660ba678f9998aca6db74f2dd912fa5124f0fa31 < e851996b32264e78a10863c2ac41a8689d7b9252 ; affected 660ba678f9998aca6db74f2dd912fa5124f0fa31 < 5d0492d1d934642bdfd2057acc1b56f4b57be465 ; affected 660ba678f9998aca6db74f2dd912fa5124f0fa31 < 18e126e97c961f7a93823795c879d7c085fe5098 ; affected a9bfb37d6ba7c376b0d53337a4c5f5ff324bd725 ; affected ed38d04342dfbe9e5aca745c8b5eb4188a74f0ef |
| Linux · Linux | affected 5.19 ; unaffected 0 < 5.19 ; unaffected 5.15.99 ≤ 5.15.* ; unaffected 6.1.16 ≤ 6.1.* ; unaffected 6.2.3 ≤ 6.2.* ; unaffected 6.3 ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |