Null Pointer Dereference in Linux Kernel's USB Type-C UCSI Driver
Summary
CVE-2023-52938: In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Don't attempt to resume the ports before they exist This will fix null pointer dereference that was caused by the driver attempting to... Affects linux versions < 6.1.11-1. Fixed in 6.1.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and extensive support for various hardware architectures. The kernel's USB Type-C UCSI driver is responsible for managing USB Type-C connections, enabling devices to communicate and charge efficiently. However, a recent vulnerability has been identified that could lead to system instability and crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been discovered in the USB Type-C UCSI driver, where the driver attempts to resume ports that have not yet been registered. This leads to a null pointer dereference, which can cause the system to crash or become unresponsive. The issue arises from the driver's logic, which fails to check the existence of the ports before attempting to resume them, potentially affecting system stability and user experience.
How To Fix
Minimum fixed version
6.1.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The CVE-2023-52938 vulnerability in the Linux kernel's USB Type-C UCSI driver poses a significant risk of system instability due to null pointer dereference. Users are urged to update to the patched version 6.1.11-1 to protect their systems. Regular monitoring of vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2023-52938 is a vulnerability in the Linux kernel's USB Type-C UCSI driver that can lead to a null pointer dereference, causing system crashes.
This vulnerability can cause instability in your system, leading to crashes or unresponsiveness when the driver attempts to resume unregistered ports.
The vulnerability affects the Linux kernel versions prior to 6.1.11-1 in Debian 12 and 13.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds available, it is recommended to monitor the situation and apply the patch as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
