NULL pointer dereference in Linux kernel clk mediatek driver

1) NULL pointer dereference

EUVDB-ID: #VU90424

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52875

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mtk_topckgen_init(), mtk_infrasys_init_early(), mtk_infrasys_init() and mtk_pericfg_init() functions in drivers/clk/mediatek/clk-mt2701.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

External links

http://git.kernel.org/stable/c/6fccee2af400edaed9cf349d506c5971d4762739
http://git.kernel.org/stable/c/1953e62366da5460dc712e045f94fb0d8918999d
http://git.kernel.org/stable/c/d1461f0c9ca0827c03730fe9652ebbf6316a2a95
http://git.kernel.org/stable/c/001e5def774fa1a8f2b29567c0b0cd3e3a859a96
http://git.kernel.org/stable/c/d1175cf4bd2b4c5f7c43f677ea1ce9ad2c18d055
http://git.kernel.org/stable/c/2a18dd653284550900b02107c3c7b3ac5e0eb802
http://git.kernel.org/stable/c/e61934720af4a58ffd43a63ffdd6f3a0bd7d7b47
http://git.kernel.org/stable/c/1bf9c204aef4cc55ce46a7ff2d4dc7e5f86551a7
http://git.kernel.org/stable/c/0d6e24b422a2166a9297a8286ff2e6ab9a5e8cd3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.