PT-2021-7679 · Linux+3 · Linux Kernel+3

Published 2021-12-22 · Updated 2024-02-27 · CVE-2023-23006

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.15.13

Description The issue is related to the misinterpretation of the mlx5 get uars page return value in the dr domain.c file of the Linux kernel, which expects it to be NULL in the error case, but it is actually an error pointer. This can lead to a denial of service.

Recommendations For versions prior to 5.15.13, update to version 5.15.13 or later to resolve the issue.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

CWE-253

Related Identifiers

ALT-PU-2022-1015

ALT-PU-2022-1016

ALT-PU-2022-1026

ALT-PU-2022-1051

ALT-PU-2022-1108

ALT-PU-2022-1240

ALT-PU-2022-1419

ALT-PU-2022-1421

ALT-PU-2023-1814

ALT-PU-2023-4894

BDU:2023-01216

CVE-2023-23006

OPENSUSE-SU-2023_2646-1

OPENSUSE-SU-2023_2871-1

SUSE-SU-2023:0778-1

SUSE-SU-2023:0779-1

SUSE-SU-2023:0780-1

SUSE-SU-2023:2140-1

SUSE-SU-2023:2141-1

SUSE-SU-2023:2231-1

SUSE-SU-2023:2646-1

SUSE-SU-2023:2809-1

SUSE-SU-2023:2871-1

Affected Products

Alt Linux

Astra Linux

Linux Kernel

Suse

References · 633

• https://github.com/torvalds/linux/commit/6b8b42585886c59a008015083282aae434349094 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2023:0778-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0779-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20241206SE81 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2871-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-23006 · Vendor Advisory
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.13 · Patch
• https://osv.dev/vulnerability/CVE-2023-23006 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-23006 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2140-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-23006 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2646-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2141-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-23006 · Security Note
• https://bdu.fstec.ru/vul/2023-01216 · Security Note