Critical NULL Pointer Dereference in Linux Kernel's STMMAC Driver
Summary
CVE-2023-53011: In the Linux kernel, the following vulnerability has been resolved: net: stmmac: enable all safety features by default In the original implementation of dwmac5 commit 8bf993a5877e ("net: stmmac: Add support for DWMAC5 an... Affects linux versions < 6.1.11-1. Fixed in 6.1.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. The STMMAC driver is responsible for Ethernet communication in various hardware platforms. This driver supports multiple safety features to enhance reliability, particularly in automotive applications. However, a recent vulnerability has been identified that could lead to system instability due to improper handling of safety feature configurations.
Vulnerability Detail
A vulnerability has been discovered in the STMMAC driver of the Linux kernel, specifically related to the handling of safety features. Initially, all safety features were enabled by default. However, subsequent changes allowed selective enabling based on platform capabilities. This led to a situation where platforms lacking specific software support could trigger a NULL pointer dereference when the automotive safety package bit is set in the hardware features register. This can result in system crashes or unexpected behavior, posing a significant risk to systems relying on this driver.
How To Fix
Minimum fixed version
6.1.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The CVE-2023-53011 vulnerability in the Linux kernel's STMMAC driver poses a significant risk due to improper handling of safety features, leading to potential system crashes. It is essential for users to update their systems to the patched version to ensure safety and stability.
See every vulnerability recorded for linux →
FAQ
CVE-2023-53011 is a vulnerability in the Linux kernel's STMMAC driver that can lead to a NULL pointer dereference, potentially causing system crashes.
The vulnerability affects Linux versions prior to 6.1.11-1 in Debian 12 and 13.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Exploiting this vulnerability can lead to system instability, crashes, and unexpected behavior, particularly in automotive applications relying on the STMMAC driver.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
