linux-cve-announce - CVE-2023-52893: gsmi: fix null-deref in gsmi_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024082111-CVE-2023-52893-02b9@gregkh>
Date: Wed, 21 Aug 2024 14:11:34 +0800
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2023-52893: gsmi: fix null-deref in gsmi_get_variable

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

gsmi: fix null-deref in gsmi_get_variable

We can get EFI variables without fetching the attribute, so we must
allow for that in gsmi.

commit 859748255b43 ("efi: pstore: Omit efivars caching EFI varstore
access layer") added a new get_variable call with attr=NULL, which
triggers panic in gsmi.

The Linux kernel CVE team has assigned CVE-2023-52893 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.0 with commit 74c5b31c6618 and fixed in 4.14.304 with commit ee5763ef829b
	Issue introduced in 3.0 with commit 74c5b31c6618 and fixed in 4.19.271 with commit 32313c11bdc8
	Issue introduced in 3.0 with commit 74c5b31c6618 and fixed in 5.4.230 with commit ffef77794fb5
	Issue introduced in 3.0 with commit 74c5b31c6618 and fixed in 5.10.165 with commit ae2a9dcc8caa
	Issue introduced in 3.0 with commit 74c5b31c6618 and fixed in 5.15.90 with commit eb0421d90f91
	Issue introduced in 3.0 with commit 74c5b31c6618 and fixed in 6.1.8 with commit 6646d769fdb0
	Issue introduced in 3.0 with commit 74c5b31c6618 and fixed in 6.2 with commit a769b05eeed7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52893
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/firmware/google/gsmi.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ee5763ef829bd923033510de6d1df7c73f085e4b
	https://git.kernel.org/stable/c/32313c11bdc8a02c577abaf865be3664ab30410a
	https://git.kernel.org/stable/c/ffef77794fb5f1245c3249b86342bad2299accb5
	https://git.kernel.org/stable/c/ae2a9dcc8caa60b1e14671294e5ec902ea5d1dfd
	https://git.kernel.org/stable/c/eb0421d90f916dffe96b4c049ddf01c0c50620d2
	https://git.kernel.org/stable/c/6646d769fdb0ce4318ef9afd127f8526d1ca8393
	https://git.kernel.org/stable/c/a769b05eeed7accc4019a1ed9799dd72067f1ce8