CVE-2023-52567

Severity CVSS v4.0:
Pending analysis
Type:
CWE-476 NULL Pointer Dereference
Publication date:
02/03/2024
Last modified:
11/12/2024

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> serial: 8250_port: Check IRQ data before use<br /> <br /> In case the leaf driver wants to use IRQ polling (irq = 0) and<br /> IIR register shows that an interrupt happened in the 8250 hardware<br /> the IRQ data can be NULL. In such a case we need to skip the wake<br /> event as we came to this path from the timer interrupt and quite<br /> likely system is already awake.<br /> <br /> Without this fix we have got an Oops:<br /> <br /> serial8250: ttyS0 at I/O 0x3f8 (irq = 0, base_baud = 115200) is a 16550A<br /> ...<br /> BUG: kernel NULL pointer dereference, address: 0000000000000010<br /> RIP: 0010:serial8250_handle_irq+0x7c/0x240<br /> Call Trace:<br /> ? serial8250_handle_irq+0x7c/0x240<br /> ? __pfx_serial8250_timeout+0x10/0x10

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.14.315 (including) 4.14.327 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.19.283 (including) 4.19.296 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.4.243 (including) 5.4.258 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.10.180 (including) 5.10.198 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.15.111 (including) 5.15.134 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.1.28 (including) 6.1.56 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.4 (including) 6.5.6 (excluding)
cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc3:*:*:*:*:*:*