CVE-2023-22997: Null Pointer Dereference
In the Linux kernel before 6.1.2, kernel/module/decompress.c misinterprets the modulegetnextpage return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-22997?
CVE-2023-22997 is classified as a high severity vulnerability in the Linux kernel.
How do I fix CVE-2023-22997?
To mitigate CVE-2023-22997, upgrade to Linux kernel versions 6.1.2 or later.
What versions of the Linux kernel are affected by CVE-2023-22997?
CVE-2023-22997 affects Linux kernel versions prior to 6.1.2.
What is the nature of CVE-2023-22997?
CVE-2023-22997 involves a misinterpretation of the return value in the kernel/module/decompress.c file, leading to potential exploitation.
Is CVE-2023-22997 fixed in recent releases?
Yes, CVE-2023-22997 has been fixed in Linux kernel version 6.1.2 and subsequent releases.