PT-2024-14655 · Linux+1 · Linux Kernel+1

Published 2023-11-24 · Updated 2024-10-31 · CVE-2023-52613

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.0-rc7+

Description The Linux kernel has a vulnerability in the drivers/thermal/loongson2 thermal module. The issue arises from an incorrect judgment of PTR ERR(), which returns -ENODEV when thermal-zones are undefined. This can lead to a NULL pointer dereference, resulting in a kernel paging request error. The error occurs because tz->type is NULL when thermal-zones are undefined.

The vulnerability can cause a kernel crash, as indicated by the error messages, including "CPU 1 Unable to handle kernel paging request" and "Oops[#1]". The issue is related to the thermal add hwmon sysfs function and the loongson2 thermal probe function.

Recommendations To resolve this issue, update the Linux kernel to a version that includes the fix for the incorrect PTR ERR() judgment in the drivers/thermal/loongson2 thermal module.

As a temporary workaround, consider disabling the loongson2 thermal module until a patch is available.

Note: The provided information does not specify the exact version that includes the fix, so it is recommended to update to the latest available version of the Linux kernel.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2025-14285

CVE-2023-52613

Affected Products

Linux Kernel

Red Os

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52613.json · Exploit
• https://git.kernel.org/stable/c/70481755ed77400e783200e2d022e5fea16060ce · Patch
• https://ubuntu.com/security/CVE-2023-52613 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14285 · Security Note
• https://git.kernel.org/stable/c/6010a9fc14eb1feab5cafd84422001134fe8ec58 · Patch
• https://osv.dev/vulnerability/CVE-2023-52613 · Vendor Advisory
• https://git.kernel.org/stable/c/15ef92e9c41124ee9d88b01208364f3fe1f45f84 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-52613 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-52613 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-52613 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-52613 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-52613 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52613 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52613 · Note
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.14 · Note