CVE-2023-23006 — NULL Pointer Dereference in Kernel

CWE-476 — NULL Pointer Dereference6 documents6 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 96.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Linux KernelDebian LinuxMsrc CBL Mariner 1.0 ARM+2 more
Timeline
PublishedMar 1
Latest updateMar 14

Description

In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5_get_uars_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages6 packages

▶NVDlinux/linux_kernel< 5.15.13
▶Debianlinux/linux_kernel< 5.10.92-1+3
▶debiandebian/linux< linux 5.15.15-1 (bookworm)

Patches

Patch: cdn.kernel.org ↗Patch: github.com ↗Patch: cdn.kernel.org ↗

🔴Vulnerability Details

2
OSV
CVE-2023-23006: In the Linux kernel before 5↗2023-03-01
▶
GHSA
GHSA-8m95-f935-7c5q: In the Linux kernel before 5↗2023-03-01
▶

📋Vendor Advisories

3
Microsoft
In the Linux kernel before 5.15.13 drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5_get_uars_page return value (expects it to be NULL in the error case whereas it is↗2023-03-14
▶
Debian
CVE-2023-23006: linux - In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/stee...↗2023
▶
Red Hat
kernel: incorrect check for error case in the mlx5_get_uars_page↗2021-12-23
▶
CVE-2023-23006 — NULL Pointer Dereference in Kernel | cvebase