NULL pointer dereference in Linux kernel - CVE-2023-3106

Vulnerability identifier: #VU79585

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-3106

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the netlink_dump() function when the Netlink socket receives the message(sendmsg) for the XFRM_MSG_GETSA, XFRM_MSG_GETPOLICY type message, and the DUMP flag is set. A local user can pass specially crafted messages to the socket and perform a denial of service (DoS) attack.

Linux kernel
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server 12 SP2 BCL
Oracle VM Server for x86
kernel-default
kernel-default-base-debuginfo
kernel-syms
kernel-default-base
kernel-default-debuginfo
kernel-default-debugsource
kernel-default-devel
kernel-source
kernel-devel
kernel-macros

Install update from vendor's website.

Linux kernel - update to 4.8 rc7
kernel-default - update to 4.4.121-92.208.1
kernel-default-base-debuginfo - update to 4.4.121-92.208.1
kernel-syms - update to 4.4.121-92.208.1
kernel-default-base - update to 4.4.121-92.208.1
kernel-default-debuginfo - update to 4.4.121-92.208.1
kernel-default-debugsource - update to 4.4.121-92.208.1
kernel-default-devel - update to 4.4.121-92.208.1
kernel-source - update to 4.4.121-92.208.1
kernel-devel - update to 4.4.121-92.208.1
kernel-macros - update to 4.4.121-92.208.1

• https://bugzilla.redhat.com/show_bug.cgi?id=2221501
• https://github.com/torvalds/linux/commit/1ba5bf993c6a3142e18e68ea6452b347f9cb5635
• https://access.redhat.com/security/cve/CVE-2023-3106

• Local denial of service in Linux kernel Netlink socket
• SUSE update for the Linux Kernel
• Multiple vulnerabilities in Oracle VM Server for x86