Vulnerability in Linux Kernel: CWE-123
Summary
CVE-2023-22995: In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is a critical component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used across various distributions, including Debian. This vulnerability, identified as CWE-123, affects the Linux kernel versions prior to 5.17. Specifically, the error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls.
Vulnerability Detail
The vulnerability in the Linux kernel before version 5.17 can lead to potential security risks. It occurs due to the absence of necessary platform_device_put and kfree calls in the error path of dwc3_qcom_acpi_register_core. This oversight can be exploited by attackers to execute arbitrary code or cause denial of service (DoS) attacks. The impact of this vulnerability is rated as critical, with a CVSSv3 score of 7.8, indicating a high level of severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can apply the following code snippet to mitigate the vulnerability:
// Workaround code
if (error_condition) {
platform_device_put(device);
kfree(data);
return error;
}
This code ensures that the platform_device_put and kfree calls are executed when the specified error condition is met, preventing the vulnerability from being exploited.
Conclusion
In conclusion, the Linux kernel versions prior to 5.17 are vulnerable to a critical security issue. To mitigate this vulnerability, it is crucial to update the kernel to version 5.17 or later. Users can obtain the fixed version through official package repositories or by compiling and installing the updated kernel source code. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The vulnerability can allow attackers to execute arbitrary code or launch denial of service attacks, potentially compromising the integrity, confidentiality, and availability of affected systems.
The vulnerability affects Linux kernel versions prior to 5.17.
Yes, updating the Linux kernel to version 5.17 or later resolves the vulnerability.
Users can update the Linux kernel by obtaining the fixed version through official package repositories or by manually compiling and installing the updated kernel source code.
Yes, a temporary workaround involves applying specific code changes to ensure the necessary calls are made in the error path. The provided code snippet demonstrates this workaround.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
