CVE-2023-52788

i915/perf: Fix NULL deref bugs with drm_dbg() calls

Severity Score

4.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

i915/perf: Fix NULL deref bugs with drm_dbg() calls

When i915 perf interface is not available dereferencing it will lead to
NULL dereferences.

As returning -ENOTSUPP is pretty clear return when perf interface is not
available.

[tursulin: added stable tag]
(cherry picked from commit 36f27350ff745bd228ab04d7845dfbffc177a889)

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: i915/perf: corrige errores de desreferencia NULL con llamadas drm_dbg(). Cuando la interfaz i915 perf no está disponible, la desreferenciación conducirá a desreferencias NULL. Como devolver -ENOTSUPP es un retorno bastante claro cuando la interfaz perf no está disponible. [tursulin: etiqueta estable agregada] (cereza seleccionada del compromiso 36f27350ff745bd228ab04d7845dfbffc177a889)

*Credits: N/A

CVSS Scores

Red Hatv3.1 4.4

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-21 CVE Reserved
2024-05-21 CVE Published
2024-05-22 EPSS Updated
2024-12-19 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-476: NULL Pointer Dereference

CAPEC

References (9)

URL	Tag	Source
https://git.kernel.org/stable/c/9b344cf6aea0a69c00e19efdc6e02c6d5aae1a23	Vuln. Introduced
https://git.kernel.org/stable/c/2fec539112e89255b6a47f566e21d99937fada7b	Vuln. Introduced

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/1566e8be73fd5fa424e88d2a4cffdc34f970f0e1	2023-11-28
https://git.kernel.org/stable/c/55db76caa782baa4a1bf02296e2773c38a524a3e	2023-11-28
https://git.kernel.org/stable/c/bf8e105030083e7b71591cdf437e464bcd8a0c09	2023-11-28
https://git.kernel.org/stable/c/10f49cdfd5fb342a1a9641930dc040c570694e98	2023-11-28
https://git.kernel.org/stable/c/471aa951bf1206d3c10d0daa67005b8e4db4ff83	2023-10-30

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2023-52788	2024-11-12
https://bugzilla.redhat.com/show_bug.cgi?id=2282652	2024-11-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.15.108 < 5.15.140 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.15.108 < 5.15.140"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 6.0 < 6.1.64 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.0 < 6.1.64"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 6.0 < 6.5.13 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.0 < 6.5.13"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 6.0 < 6.6.3 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.0 < 6.6.3"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 6.0 < 6.7 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.0 < 6.7"		en		Affected