| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024052120-CVE-2023-52869-6f57@gregkh> Date: Tue, 21 May 2024 17:32:45 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2023-52869: pstore/platform: Add check for kstrdup Description =========== In the Linux kernel, the following vulnerability has been resolved: pstore/platform: Add check for kstrdup Add check for the return value of kstrdup() and return the error if it fails in order to avoid NULL pointer dereference. The Linux kernel CVE team has assigned CVE-2023-52869 to this issue. Affected and fixed versions =========================== Issue introduced in 5.8 with commit 563ca40ddf40 and fixed in 5.10.201 with commit bb166bdae1a7 Issue introduced in 5.8 with commit 563ca40ddf40 and fixed in 5.15.139 with commit 379b120e4f27 Issue introduced in 5.8 with commit 563ca40ddf40 and fixed in 6.1.63 with commit 63f637309baa Issue introduced in 5.8 with commit 563ca40ddf40 and fixed in 6.5.12 with commit 1c426da79f9f Issue introduced in 5.8 with commit 563ca40ddf40 and fixed in 6.6.2 with commit ad5cb6deb414 Issue introduced in 5.8 with commit 563ca40ddf40 and fixed in 6.7 with commit a19d48f7c5d5 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-52869 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/pstore/platform.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/bb166bdae1a7d7db30e9be7e6ccaba606debc05f https://git.kernel.org/stable/c/379b120e4f27fd1cf636a5f85570c4d240a3f688 https://git.kernel.org/stable/c/63f637309baadf81a095f2653e3b807d4b5814b9 https://git.kernel.org/stable/c/1c426da79f9fc7b761021b5eb44185ba119cd44a https://git.kernel.org/stable/c/ad5cb6deb41417ef41b9d6ff54f789212108606f https://git.kernel.org/stable/c/a19d48f7c5d57c0f0405a7d4334d1d38fe9d3c1c
Powered by blists - more mailing lists