CVE-2023-52901

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52901
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Check endpoint is valid before dereferencing it When the host controller is not responding, all URBs queued to all endpoints need to be killed. This can cause a kernel panic if we dereference an invalid endpoint. Fix this by using xhci_get_virt_ep() helper to find the endpoint and checking if the endpoint is valid before dereferencing it. [233311.853271] xhci-hcd xhci-hcd.1.auto: xHCI host controller not responding, assume dead [233311.853393] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e8 [233311.853964] pc : xhci_hc_died+0x10c/0x270 [233311.853971] lr : xhci_hc_died+0x1ac/0x270 [233311.854077] Call trace: [233311.854085] xhci_hc_died+0x10c/0x270 [233311.854093] xhci_stop_endpoint_command_watchdog+0x100/0x1a4 [233311.854105] call_timer_fn+0x50/0x2d4 [233311.854112] expire_timers+0xac/0x2e4 [233311.854118] run_timer_softirq+0x300/0xabc [233311.854127] __do_softirq+0x148/0x528 [233311.854135] irq_exit+0x194/0x1a8 [233311.854143] __handle_domain_irq+0x164/0x1d0 [233311.854149] gic_handle_irq.22273+0x10c/0x188 [233311.854156] el1_irq+0xfc/0x1a8 [233311.854175] lpm_cpuidle_enter+0x25c/0x418 [msm_pm] [233311.854185] cpuidle_enter_state+0x1f0/0x764 [233311.854194] do_idle+0x594/0x6ac [233311.854201] cpu_startup_entry+0x7c/0x80 [233311.854209] secondary_start_kernel+0x170/0x198

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/08864dc14a6803f0377ca77b9740b26db30c020f Patch
https://git.kernel.org/stable/c/2d2820d5f375563690c96e60676855205abfb7f5 Patch
https://git.kernel.org/stable/c/375be2dd61a072f7b1cac9b17eea59e07b58db3a Patch
https://git.kernel.org/stable/c/66fc1600855c05c4ba4e997184c91cf298e0405c Patch
https://git.kernel.org/stable/c/9891e5c73cab3fd9ed532dc50e9799e55e974766 Patch
https://git.kernel.org/stable/c/e8fb5bc76eb86437ab87002d4a36d6da02165654 Patch
https://git.kernel.org/stable/c/f39c813af0b64f44af94e435c07bfa1ddc2575f5 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*
History

13 Sep 2024, 13:37

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/08864dc14a6803f0377ca77b9740b26db30c020f - () https://git.kernel.org/stable/c/08864dc14a6803f0377ca77b9740b26db30c020f - Patch
References () https://git.kernel.org/stable/c/2d2820d5f375563690c96e60676855205abfb7f5 - () https://git.kernel.org/stable/c/2d2820d5f375563690c96e60676855205abfb7f5 - Patch
References () https://git.kernel.org/stable/c/375be2dd61a072f7b1cac9b17eea59e07b58db3a - () https://git.kernel.org/stable/c/375be2dd61a072f7b1cac9b17eea59e07b58db3a - Patch
References () https://git.kernel.org/stable/c/66fc1600855c05c4ba4e997184c91cf298e0405c - () https://git.kernel.org/stable/c/66fc1600855c05c4ba4e997184c91cf298e0405c - Patch
References () https://git.kernel.org/stable/c/9891e5c73cab3fd9ed532dc50e9799e55e974766 - () https://git.kernel.org/stable/c/9891e5c73cab3fd9ed532dc50e9799e55e974766 - Patch
References () https://git.kernel.org/stable/c/e8fb5bc76eb86437ab87002d4a36d6da02165654 - () https://git.kernel.org/stable/c/e8fb5bc76eb86437ab87002d4a36d6da02165654 - Patch
References () https://git.kernel.org/stable/c/f39c813af0b64f44af94e435c07bfa1ddc2575f5 - () https://git.kernel.org/stable/c/f39c813af0b64f44af94e435c07bfa1ddc2575f5 - Patch
CWE CWE-476
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

21 Aug 2024, 12:30

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: usb: xhci: verifique que el endpoint sea válido antes de desreferenciarlo. Cuando el controlador de host no responde, se deben eliminar todas las URB en cola para todos los endpoints. Esto puede provocar un pánico en el kernel si eliminamos la referencia a un endpoint no válido. Solucione este problema utilizando el asistente xhci_get_virt_ep() para encontrar el endpoint y comprobar si es válido antes de desreferenciarlo. [233311.853271] xhci-hcd xhci-hcd.1.auto: El controlador de host xHCI no responde, se supone muerto [233311.853393] No se puede manejar la desreferencia del puntero NULL del kernel en la dirección virtual 00000000000000e8 [233311.853964] pc: xhci_hc_died+0x10c/ 0x270 [233311.853971] lr : xhci_hc_died+0x1ac/0x270 [233311.854077] Rastreo de llamadas: [233311.854085] xhci_hc_died+0x10c/0x270 [233311.854093] xhci_stop_endpoint_command_watchdog+0x100/0x1a4 11.854105] call_timer_fn+0x50/0x2d4 [233311.854112] expire_timers+0xac/0x2e4 [233311.854118] run_timer_softirq+0x300 /0xabc [233311.854127] __do_softirq+0x148/0x528 [233311.854135] irq_exit+0x194/0x1a8 [233311.854143] __handle_domain_irq+0x164/0x1d0 [233311.854149] gic_handle_irq.22273+0x10c/0x188 [233311.854156] el1_irq+0xfc/0x1a8 [233311.854175] lpm_cpuidle_enter+0x25c /0x418 [msm_pm] [233311.854185] cpuidle_enter_state+0x1f0/0x764 [233311.854194] do_idle+0x594/0x6ac [233311.854201] cpu_startup_entry+0x7c/0x80 [233311.8542 09] kernel_inicio_secundario+0x170/0x198

21 Aug 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-21 07:15

Updated : 2024-09-13 13:37

NVD link : CVE-2023-52901

Mitre link : CVE-2023-52901

CVE.ORG link : CVE-2023-52901

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference