Denial of service in Linux kernel mtd

1) NULL pointer dereference

EUVDB-ID: #VU87742

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52449

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in mtd. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Linux kernel: before 5.4.268

External links

http://git.kernel.org/stable/c/aeba358bcc8ffddf9b4a9bd0e5ec9eb338d46022
http://git.kernel.org/stable/c/1bf4fe14e97cda621522eb2f28b0a4e87c5b0745
http://git.kernel.org/stable/c/001a3f59d8c914ef8273461d4bf495df384cc5f8
http://git.kernel.org/stable/c/d8ac2537763b54d278b80b2b080e1652523c7d4c
http://git.kernel.org/stable/c/5389407bba1eab1266c6d83e226fb0840cb98dd5
http://git.kernel.org/stable/c/cfd7c9d260dc0a3baaea05a122a19ab91e193c65
http://git.kernel.org/stable/c/b36aaa64d58aaa2f2cbc8275e89bae76a2b6c3dc
http://git.kernel.org/stable/c/a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.