Critical NULL Pointer Dereference in Linux Kernel: linux Package Vulnerability
Summary
DEBIAN-CVE-2023-53180: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid NULL pointer access during management transmit cleanup Currently 'ar' reference is not added in skb_cb. Affects linux versions < 6.4.11-1. Fixed in 6.4.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the Linux kernel that manages system resources and hardware interactions. It is essential for the operation of the OS, enabling communication between software and hardware. This vulnerability affects versions of the linux package in Debian 13 and 14, potentially leading to system instability and security risks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ath12k wireless driver that allows for a NULL pointer dereference during the cleanup of management transmit operations. This issue arises because the 'ar' reference is not correctly added in the skb_cb structure. While this reference is typically unused during transmit completion callbacks, it becomes critical during interface removal when the remaining idr cleanup callback attempts to access the 'ar' pointer from skb_cb. If the pointer is NULL, it can lead to a system crash or unexpected behavior, compromising system stability and security.
How To Fix
Minimum fixed version
6.4.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified vulnerability in the Linux kernel's ath12k driver poses a significant risk due to potential NULL pointer dereference issues. Users of the linux package in Debian 13 and 14 should prioritize updating to the patched version 6.4.11-1 to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert is also recommended.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a NULL pointer dereference in the ath12k wireless driver of the Linux kernel, which can lead to system crashes.
The vulnerability affects the linux package in Debian 13 and 14 prior to version 6.4.11-1.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds, it is advisable to limit the use of affected interfaces until the patch can be applied.
Detailed information about this vulnerability can be found in the Debian security advisories and the official Linux kernel documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
