SB2024082170 - NULL pointer dereference in Linux kernel usb host driver
Published: August 21, 2024 Updated: May 12, 2025
Security Bulletin ID
SB2024082170
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) NULL pointer dereference (CVE-ID: CVE-2023-52898)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to NULL pointer dereference within the xhci_free_dev() function in drivers/usb/host/xhci.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/6fac4b5cecb3928a0a81069aaa815a2edc8dd5a1
- https://git.kernel.org/stable/c/133b902378e4acbd824c29dd0d48570ad596e368
- https://git.kernel.org/stable/c/081105213ff6f661c114781d469233c7d0e09c2e
- https://git.kernel.org/stable/c/c462ac871f49753eca86bb960f573b993976a5ea
- https://git.kernel.org/stable/c/ea2ee5e9991caf74e0604f994c1831a5867055b2
- https://git.kernel.org/stable/c/a2bc47c43e70cf904b1af49f76d572326c08bca7
- https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.271
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.165
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.90
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.230
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.8
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2