SB2024082164 - NULL pointer dereference in Linux kernel gadget function driver
Published: August 21, 2024 Updated: May 12, 2025
Security Bulletin ID
SB2024082164
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) NULL pointer dereference (CVE-ID: CVE-2023-52894)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to NULL pointer dereference within the func_to_ncm() function in drivers/usb/gadget/function/f_ncm.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/fef6b29671b66dfb71f17e337c1ad14b5a2cedae
- https://git.kernel.org/stable/c/63d161f29cd39c050e8873aa36e0c9fc013bb763
- https://git.kernel.org/stable/c/a21da7f7aae618c785f7e4a275d43c06dc8412b6
- https://git.kernel.org/stable/c/e92c70059178da751e5af7de02384b7dfadb5ec7
- https://git.kernel.org/stable/c/a69c8dfb85b44be9cc223be07d35cc3a9baefbea
- https://git.kernel.org/stable/c/09e4507ec8ef2d44da6ba4092b8ee2d81f216497
- https://git.kernel.org/stable/c/c6ec929595c7443250b2a4faea988c62019d5cd2
- https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.304
- https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.271
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.165
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.90
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.230
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.8
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2