PT-2022-6412 · Linux+3 · Linux Kernel+3

Published 2022-11-11 · Updated 2025-03-20 · CVE-2023-22997

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.2

Description The issue is related to the misinterpretation of the module get next page return value in the kernel/module/decompress.c file, which expects NULL in the error case but actually receives an error pointer. This can lead to a denial of service. The functions module gzip decompress() and module xz decompress() are affected by this incorrect error value check.

Recommendations For Linux kernel versions prior to 6.1.2, update to version 6.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable decompress.c module to minimize the risk of exploitation.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

CWE-253

Related Identifiers

ALT-PU-2023-1023

ALT-PU-2023-1064

ALT-PU-2023-1684

ALT-PU-2023-1741

ALT-PU-2023-1814

ALT-PU-2023-4894

ALT-PU-2024-4263

ALT-PU-2024-4843

AZL-13824

BDU:2023-01209

CVE-2023-22997

USN-6024-1

Affected Products

Alt Linux

Linuxmint

Linux Kernel

Ubuntu

References · 31

• https://github.com/torvalds/linux/commit/45af1d7aae7d5520d2858f8517a1342646f015db · Patch
• https://ubuntu.com/security/CVE-2022-3424 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-22997 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-22997 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-1032 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6024-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-13824 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-1281 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-47929 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22997 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0468 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22997 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22997 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-41218 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-28328 · Vendor Advisory