NULL pointer dereference in Linux kernel - CVE-2023-22999

Vulnerability identifier: #VU73914

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-22999

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the dwc3_qcom_create_urs_usb_platdev() function in drivers/usb/dwc3/dwc3-qcom.c. A local can pass specially crafted data to the system and perform a denial of service (DoS) attack.

Linux kernel
openEuler
kernel
bpftool
kernel-tools-devel
kernel-devel
perf-debuginfo
kernel-headers
perf
python3-perf
kernel-debuginfo
python3-perf-debuginfo
kernel-tools
kernel-source
bpftool-debuginfo
kernel-tools-debuginfo
kernel-debugsource

Install updates from vendor's website.

Linux kernel - update to 5.16.3
kernel - update to 5.10.0-60.87.0.111
bpftool - update to 5.10.0-60.87.0.111
kernel-tools-devel - update to 5.10.0-60.87.0.111
kernel-devel - update to 5.10.0-60.87.0.111
perf-debuginfo - update to 5.10.0-60.87.0.111
kernel-headers - update to 5.10.0-60.87.0.111
perf - update to 5.10.0-60.87.0.111
python3-perf - update to 5.10.0-60.87.0.111
kernel-debuginfo - update to 5.10.0-60.87.0.111
python3-perf-debuginfo - update to 5.10.0-60.87.0.111
kernel-tools - update to 5.10.0-60.87.0.111
kernel-source - update to 5.10.0-60.87.0.111
bpftool-debuginfo - update to 5.10.0-60.87.0.111
kernel-tools-debuginfo - update to 5.10.0-60.87.0.111
kernel-debugsource - update to 5.10.0-60.87.0.111

• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3
• https://github.com/torvalds/linux/commit/b52fe2dbb3e655eb1483000adfab68a219549e13

• Local denial of service in Linux kernel dwc3 driver
• openEuler 22.03 LTS update for kernel