CVE-2023-52749 Affecting cluster-md-kmp-default package, versions <6.4.0-150600.23.14.2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-SLES156-CLUSTERMDKMPDEFAULT-7548817
- published 23 Jul 2024
- disclosed 22 Jul 2024
Introduced: 22 Jul 2024
CVE-2023-52749 Open this link in a new tabHow to fix?
Upgrade SLES:15.6
cluster-md-kmp-default
to version 6.4.0-150600.23.14.2 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream cluster-md-kmp-default
package and not the cluster-md-kmp-default
package as distributed by SLES
.
See How to fix?
for SLES:15.6
relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
spi: Fix null dereference on suspend
A race condition exists where a synchronous (noqueue) transfer can be active during a system suspend. This can cause a null pointer dereference exception to occur when the system resumes.
Example order of events leading to the exception:
- spi_sync() calls __spi_transfer_message_noqueue() which sets ctlr->cur_msg
- Spi transfer begins via spi_transfer_one_message()
- System is suspended interrupting the transfer context
- System is resumed
- spi_controller_resume() calls spi_start_queue() which resets cur_msg to NULL
- Spi transfer context resumes and spi_finalize_current_message() is called which dereferences cur_msg (which is now NULL)
Wait for synchronous transfers to complete before suspending by acquiring the bus mutex and setting/checking a suspend flag.
References
- https://www.suse.com/security/cve/CVE-2023-52749.html
- https://bugzilla.suse.com/1225476
- https://git.kernel.org/stable/c/4ec4508db97502a12daee88c74782e8d35ced068
- https://git.kernel.org/stable/c/96474ea47dc67b0704392d59192b233c8197db0e
- https://git.kernel.org/stable/c/bef4a48f4ef798c4feddf045d49e53c8a97d5e37