CVE-2024-53233

Severity CVSS v4.0:
Pending analysis
Type:
CWE-476 NULL Pointer Dereference
Publication date:
27/12/2024
Last modified:
03/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> unicode: Fix utf8_load() error path<br /> <br /> utf8_load() requests the symbol "utf8_data_table" and then checks if the<br /> requested UTF-8 version is supported. If it&amp;#39;s unsupported, it tries to<br /> put the data table using symbol_put(). If an unsupported version is<br /> requested, symbol_put() fails like this:<br /> <br /> kernel BUG at kernel/module/main.c:786!<br /> RIP: 0010:__symbol_put+0x93/0xb0<br /> Call Trace:<br /> <br /> ? __die_body.cold+0x19/0x27<br /> ? die+0x2e/0x50<br /> ? do_trap+0xca/0x110<br /> ? do_error_trap+0x65/0x80<br /> ? __symbol_put+0x93/0xb0<br /> ? exc_invalid_op+0x51/0x70<br /> ? __symbol_put+0x93/0xb0<br /> ? asm_exc_invalid_op+0x1a/0x20<br /> ? __pfx_cmp_name+0x10/0x10<br /> ? __symbol_put+0x93/0xb0<br /> ? __symbol_put+0x62/0xb0<br /> utf8_load+0xf8/0x150<br /> <br /> That happens because symbol_put() expects the unique string that<br /> identify the symbol, instead of a pointer to the loaded symbol. Fix that<br /> by using such string.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.17 (including) 6.1.120 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.64 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.11.11 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.12 (including) 6.12.2 (excluding)