#VU93673 Input validation error in Linux kernel - CVE-2023-52882

Vulnerability identifier: #VU93673

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52882

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the sun50i_h6_ccu_probe() function in drivers/clk/sunxi-ng/ccu-sun50i-h6.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/fe11826ffa200e1a7a826e745163cb2f47875f66
https://git.kernel.org/stable/c/bfc78b4628497eb6df09a6b5bba9dd31616ee175
https://git.kernel.org/stable/c/f1fa9a9816204ac4b118b2e613d3a7c981355019
https://git.kernel.org/stable/c/70f64cb29014e4c4f1fabd3265feebd80590d069
https://git.kernel.org/stable/c/0b82eb134d2942ecc669e2ab2be3f0a58d79428a
https://git.kernel.org/stable/c/9708e5081cfc4f085690294163389bcf82655f90
https://git.kernel.org/stable/c/7e91ed763dc07437777bd012af7a2bd4493731ff
https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.