linux-cve-announce - CVE-2023-52789: tty: vcc: Add check for kstrdup() in vcc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024052156-CVE-2023-52789-6006@gregkh>
Date: Tue, 21 May 2024 17:31:25 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2023-52789: tty: vcc: Add check for kstrdup() in vcc_probe()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tty: vcc: Add check for kstrdup() in vcc_probe()

Add check for the return value of kstrdup() and return the error, if it
fails in order to avoid NULL pointer dereference.

The Linux kernel CVE team has assigned CVE-2023-52789 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.14.331 with commit 38cd56fc9de7
	Fixed in 4.19.300 with commit 909963e0c167
	Fixed in 5.4.262 with commit 460284dfb10b
	Fixed in 5.10.202 with commit 4ef41a7f33ff
	Fixed in 5.15.140 with commit 6c80f48912b5
	Fixed in 6.1.64 with commit 7cebc86481bf
	Fixed in 6.5.13 with commit 4a24a3182624
	Fixed in 6.6.3 with commit 8f8771757b13
	Fixed in 6.7 with commit d81ffb87aaa7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52789
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/tty/vcc.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/38cd56fc9de78bf3c878790785e8c231116ef9d3
	https://git.kernel.org/stable/c/909963e0c16778cec28efb1affc21558825f4200
	https://git.kernel.org/stable/c/460284dfb10b207980c6f3f7046e33446ceb38ac
	https://git.kernel.org/stable/c/4ef41a7f33ffe1a335e7db7e1564ddc6afad47cc
	https://git.kernel.org/stable/c/6c80f48912b5bd4965352d1a9a989e21743a4a06
	https://git.kernel.org/stable/c/7cebc86481bf16049e266f6774d90f2fd4f8d5d2
	https://git.kernel.org/stable/c/4a24a31826246b15477399febd13292b0c9f0ee9
	https://git.kernel.org/stable/c/8f8771757b130383732195497e47fba2aba76d3a
	https://git.kernel.org/stable/c/d81ffb87aaa75f842cd7aa57091810353755b3e6