Kernel NULL Pointer Dereference Vulnerability in Linux Package - CVE-2023-52994
Summary
CVE-2023-52994: In the Linux kernel, the following vulnerability has been resolved: acpi: Fix suspend with Xen PV Commit f1e525009493 ("x86/boot: Skip realmode init code when running as Xen PV guest") missed one code path accessing real... Affects linux versions < 6.1.11-1. Fixed in 6.1.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of Linux operating systems, responsible for managing hardware resources and providing essential services to software applications. It is widely used across various platforms, including servers, desktops, and embedded systems. This vulnerability affects the ACPI (Advanced Configuration and Power Interface) subsystem, which is crucial for power management and device configuration in Linux environments.
Vulnerability Detail
CVE-2023-52994 is a vulnerability in the Linux kernel that arises from a missed code path in the ACPI subsystem when running as a Xen PV (Paravirtualized) guest. This oversight leads to a NULL pointer dereference during system suspension, potentially causing a system crash or hang. The vulnerability is triggered when the system attempts to access a real_mode_header that has not been properly initialized, resulting in a kernel panic. The issue was introduced in commit f1e525009493 and affects systems utilizing Xen virtualization technology.
How To Fix
Minimum fixed version
6.1.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid suspending the system while running as a Xen PV guest until the patch is applied. Additionally, users can disable ACPI features if not required, but this may affect power management functionalities.
Conclusion
CVE-2023-52994 is a critical vulnerability in the Linux kernel affecting systems running as Xen PV guests. Users are advised to update to the patched version to mitigate risks associated with system crashes during suspension. For those unable to update immediately, temporary workarounds are available.
See every vulnerability recorded for linux →
FAQ
CVE-2023-52994 is a vulnerability in the Linux kernel that can cause a kernel panic due to a NULL pointer dereference during system suspension in Xen PV environments.
If your system is running a vulnerable version of the Linux kernel as a Xen PV guest, it may crash or hang when attempting to suspend, leading to potential data loss or system instability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
Yes, the permanent fix is to update your Linux kernel to version 6.1.11-1 or later, which addresses the vulnerability.
If an immediate update is not possible, avoid suspending your system while running as a Xen PV guest and consider disabling ACPI features temporarily.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
