Kernel NULL Pointer Dereference Vulnerability in Linux Package - CVE-2023-53144
Summary
CVE-2023-53144: In the Linux kernel, the following vulnerability has been resolved: erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms As the call trace shown, the root cause is kunmap incorrect pages: BUG: kernel NULL pointer... Affects linux versions < 6.1.20-1. Fixed in 6.1.20-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of Linux operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. This vulnerability affects the Linux kernel versions in Debian 12 and 13, specifically related to the erofs filesystem when using LZMA compression on HIGHMEM platforms.
Vulnerability Detail
CVE-2023-53144 is a vulnerability in the Linux kernel that arises from an incorrect handling of memory mapping (kunmap) when decompressing LZMA data on HIGHMEM platforms. This flaw can lead to a kernel NULL pointer dereference, resulting in potential system crashes or instability. The issue was traced back to the z_erofs_lzma_decompress function, which mishandles memory, causing a critical failure in the kernel's operation.
How To Fix
Minimum fixed version
6.1.20-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the kernel as described in the 'how_to_fix' section.
Conclusion
CVE-2023-53144 is a critical vulnerability in the Linux kernel that can lead to system instability due to improper memory handling. Users are advised to update their kernel to the fixed version to mitigate risks associated with this vulnerability.
See every vulnerability recorded for linux →
FAQ
CVE-2023-53144 is a vulnerability in the Linux kernel that can cause a kernel NULL pointer dereference due to incorrect memory handling when decompressing LZMA data.
The vulnerability affects Linux kernel versions in Debian 12 and 13 prior to version 6.1.20-1.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability can lead to system crashes or instability, particularly on HIGHMEM platforms when using the erofs filesystem with LZMA compression.
There are no specific workarounds available. The recommended action is to update the Linux kernel to the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
