CVE-2023-1382: Null Pointer Dereference
A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel.
Other sources
A data race happens between con is allocated and con->sock is set, leading to null pointer dereference when accessing con->sock->sk. The null pointer dereference issue was found in tipc protocol in net/tipc/topsrv.c in Linux before 6.0.
Reference: https://lore.kernel.org/netdev/bc7bd3183f1c275c820690fc65b708238fe9e38e.1668807842.git.lucien.xin@gmail.com/T/#u
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference flaw when accessing con->sock->sk in net/tipc/topsrv.c in the tipc protocol. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause the system to crash.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.el9_2 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.rt14.296.el9_2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 6.1 - Configuration
Add the TIPC kernel module (tipc) to the kernel module blacklist file to prevent it from loading automatically during boot.
Linux kernel TIPC protocol module module blacklist = tipc
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2023-1382?
CVE-2023-1382 has been classified as a medium severity vulnerability.
How do I fix CVE-2023-1382?
To mitigate CVE-2023-1382, upgrade to kernel version 0:5.14.0-284.11.1.el9_2 or apply other specified patches.
Which systems are affected by CVE-2023-1382?
CVE-2023-1382 affects various Linux kernel versions including 5.14 and 6.1, as well as specific IBM Security products.
What type of vulnerability is CVE-2023-1382?
CVE-2023-1382 is a data race flaw in the Linux kernel affecting the tipc protocol.
What is the impact of CVE-2023-1382?
The impact of CVE-2023-1382 is a potential NULL pointer dereference that could lead to system instability.