#VU98973 NULL pointer dereference in Linux kernel - CVE-2023-52917

Vulnerability identifier: #VU98973

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52917

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ndev_init_debugfs() function in drivers/ntb/hw/intel/ntb_hw_gen1.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/ef7e34237e2612b116a84c9640628a6f7a0d693e
https://git.kernel.org/stable/c/a429158f2e0a7a03eb67fd5e204e1f6735c725aa
https://git.kernel.org/stable/c/7cbd6d7fb9ba2be03978809c848e2e50eaeead2c
https://git.kernel.org/stable/c/16e5bed6c1883b19f9fcbdff996aa3381954d5f3
https://git.kernel.org/stable/c/b66bf833e72a1e23d7ccafc0f8f74e80f8c357b5
https://git.kernel.org/stable/c/babba8595d1e5d57313a6187f3e51aceacc6881a
https://git.kernel.org/stable/c/e229897d373a87ee09ec5cc4ecd4bb2f895fc16b

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.