CVE-2023-52472

In the Linux kernel, the following vulnerability has been resolved: crypto: rsa - add a check for allocation failure Static checkers insist that the mpi_alloc() allocation can fail so add a check to prevent a NULL dereference. Small allocations like this can't actually fail in current kernels, but adding a check is very simple and makes the static checkers happy.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/2831f4d3bfa68e64c5f83e96688be779c87b3511	Patch
https://git.kernel.org/stable/c/95ad8b6879e2e49d02e3bfc0e1fb46421633fe2a	Patch
https://git.kernel.org/stable/c/d872ca165cb67112f2841ef9c37d51ef7e63d1e4	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

17 Apr 2024, 18:47

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
CPE		cpe:2.3:o:linux:linux_kernel::::::::
First Time		Linux linux Kernel Linux
References	~~() https://git.kernel.org/stable/c/2831f4d3bfa68e64c5f83e96688be779c87b3511 -~~	() https://git.kernel.org/stable/c/2831f4d3bfa68e64c5f83e96688be779c87b3511 - Patch
References	~~() https://git.kernel.org/stable/c/95ad8b6879e2e49d02e3bfc0e1fb46421633fe2a -~~	() https://git.kernel.org/stable/c/95ad8b6879e2e49d02e3bfc0e1fb46421633fe2a - Patch
References	~~() https://git.kernel.org/stable/c/d872ca165cb67112f2841ef9c37d51ef7e63d1e4 -~~	() https://git.kernel.org/stable/c/d872ca165cb67112f2841ef9c37d51ef7e63d1e4 - Patch
CWE		CWE-476

26 Feb 2024, 16:32

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-02-26 16:27

Updated : 2024-04-17 18:47

NVD link : CVE-2023-52472

Mitre link : CVE-2023-52472

CVE.ORG link : CVE-2023-52472

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2023-52472", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-02-26T16:27:48.930", "references": [{"url": "https://git.kernel.org/stable/c/2831f4d3bfa68e64c5f83e96688be779c87b3511", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/95ad8b6879e2e49d02e3bfc0e1fb46421633fe2a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d872ca165cb67112f2841ef9c37d51ef7e63d1e4", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: rsa - add a check for allocation failure\n\nStatic checkers insist that the mpi_alloc() allocation can fail so add\na check to prevent a NULL dereference. Small allocations like this\ncan't actually fail in current kernels, but adding a check is very\nsimple and makes the static checkers happy."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: crypto: rsa: agregue una verificaci\u00f3n para fallas en la asignaci\u00f3n. Los verificadores est\u00e1ticos insisten en que la asignaci\u00f3n mpi_alloc() puede fallar, as\u00ed que agregue una verificaci\u00f3n para evitar una desreferencia NULL. Peque\u00f1as asignaciones como esta en realidad no pueden fallar en los kernels actuales, pero agregar una verificaci\u00f3n es muy simple y hace felices a los verificadores est\u00e1ticos."}], "lastModified": "2024-04-17T18:47:08.097", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AEB24C6C-17A5-4F5F-8CFC-03547EC0A568", "versionEndExcluding": "6.6.14", "versionStartIncluding": "6.5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0EA3778C-730B-464C-8023-18CA6AC0B807", "versionEndExcluding": "6.7.2", "versionStartIncluding": "6.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}