CVE-2023-52915

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52915
In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer In af9035_i2c_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach af9035_i2c_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0143f282b15f7cedc0392ea10050fb6000fd16e6 Patch
https://git.kernel.org/stable/c/41b7181a40af84448a2b144fb02d8bf32b7e9a23 Patch
https://git.kernel.org/stable/c/6c01ef65de0b321b2db1ef9abf8f1d15862b937e Patch
https://git.kernel.org/stable/c/7bf744f2de0a848fb1d717f5831b03db96feae89 Patch
https://git.kernel.org/stable/c/b2f54ed7739dfdf42c4df0a11131aad7c8635464 Patch
https://git.kernel.org/stable/c/b49c6e5dd236787f13a062ec528d724169f11152 Patch
https://git.kernel.org/stable/c/d9ef84a7c222497ecb5fdf93361c76931804825e Patch
https://git.kernel.org/stable/c/fa58d9db5cad4bb7bb694b6837e3b96d87554f2b Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

10 Sep 2024, 17:12

Type Values Removed Values Added
CWE CWE-476
References () https://git.kernel.org/stable/c/0143f282b15f7cedc0392ea10050fb6000fd16e6 - () https://git.kernel.org/stable/c/0143f282b15f7cedc0392ea10050fb6000fd16e6 - Patch
References () https://git.kernel.org/stable/c/41b7181a40af84448a2b144fb02d8bf32b7e9a23 - () https://git.kernel.org/stable/c/41b7181a40af84448a2b144fb02d8bf32b7e9a23 - Patch
References () https://git.kernel.org/stable/c/6c01ef65de0b321b2db1ef9abf8f1d15862b937e - () https://git.kernel.org/stable/c/6c01ef65de0b321b2db1ef9abf8f1d15862b937e - Patch
References () https://git.kernel.org/stable/c/7bf744f2de0a848fb1d717f5831b03db96feae89 - () https://git.kernel.org/stable/c/7bf744f2de0a848fb1d717f5831b03db96feae89 - Patch
References () https://git.kernel.org/stable/c/b2f54ed7739dfdf42c4df0a11131aad7c8635464 - () https://git.kernel.org/stable/c/b2f54ed7739dfdf42c4df0a11131aad7c8635464 - Patch
References () https://git.kernel.org/stable/c/b49c6e5dd236787f13a062ec528d724169f11152 - () https://git.kernel.org/stable/c/b49c6e5dd236787f13a062ec528d724169f11152 - Patch
References () https://git.kernel.org/stable/c/d9ef84a7c222497ecb5fdf93361c76931804825e - () https://git.kernel.org/stable/c/d9ef84a7c222497ecb5fdf93361c76931804825e - Patch
References () https://git.kernel.org/stable/c/fa58d9db5cad4bb7bb694b6837e3b96d87554f2b - () https://git.kernel.org/stable/c/fa58d9db5cad4bb7bb694b6837e3b96d87554f2b - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer En af9035_i2c_master_xfer, msg está controlado por el usuario. Cuando msg[i].buf es nulo y msg[i].len es cero, se pasarían las comprobaciones anteriores en msg[i].buf. Los datos maliciosos finalmente llegan a af9035_i2c_master_xfer. Si se accede a msg[i].buf[0] sin una comprobación de cordura, se produciría una desreferencia nula de ptr. Agregamos una comprobación en msg[i].len para evitar un bloqueo. Commit similar: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

06 Sep 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-06 09:15

Updated : 2024-09-10 17:12

NVD link : CVE-2023-52915

Mitre link : CVE-2023-52915

CVE.ORG link : CVE-2023-52915

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference