NULL Pointer Dereference Affecting kernel-rt-debug-modules-core package, versions <0:5.14.0-284.75.1.rt14.360.el9_2


Severity

Recommended
high

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.05% (17th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about NULL Pointer Dereference vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RHEL9-KERNELRTDEBUGMODULESCORE-7559160
  • published25 Jul 2024
  • disclosed21 May 2024

Introduced: 21 May 2024

CVE-2023-52811  (opens in a new tab)
CWE-476  (opens in a new tab)
First added by Snyk

How to fix?

Upgrade RHEL:9 kernel-rt-debug-modules-core to version 0:5.14.0-284.75.1.rt14.360.el9_2 or higher.
This issue was patched in RHSA-2024:4831.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-rt-debug-modules-core package and not the kernel-rt-debug-modules-core package as distributed by RHEL. See How to fix? for RHEL:9 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool

In practice the driver should never send more commands than are allocated to a queue's event pool. In the unlikely event that this happens, the code asserts a BUG_ON, and in the case that the kernel is not configured to crash on panic returns a junk event pointer from the empty event list causing things to spiral from there. This BUG_ON is a historical artifact of the ibmvfc driver first being upstreamed, and it is well known now that the use of BUG_ON is bad practice except in the most unrecoverable scenario. There is nothing about this scenario that prevents the driver from recovering and carrying on.

Remove the BUG_ON in question from ibmvfc_get_event() and return a NULL pointer in the case of an empty event pool. Update all call sites to ibmvfc_get_event() to check for a NULL pointer and perfrom the appropriate failure or recovery action.

CVSS Scores

version 3.1