CVE-2023-4459: Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup()
A NULL pointer dereference flaw was found in vmxnet3rqcleanup in drivers/net/vmxnet3/vmxnet3drv.c in networking sub-component in vmxnet3 in the Linux Kernel. In this flaw a local attacker with normal user privilege may lead to a denial of service problem due to a missing sanity check while cleanup.
In vmxnet3rqcreate(), when dmaalloccoherent() fails, vmxnet3rqdestroy() is called. It sets rq->rxring[i].base to NULL. Then vmxnet3rqcreate() returns an error to its callers mxnet3rqcreateall() -> vmxnet3changemtu(). Then vmxnet3changemtu() calls vmxnet3forceclose() -> devclose() in error handling code. And the driver calls vmxnet3close() -> vmxnet3quiescedev() -> vmxnet3rqcleanupall() -> vmxnet3rqcleanup(). In vmxnet3rqcleanup(), rq->rxring[ringidx].base is accessed, but this variable is NULL, causing a NULL pointer dereference.
References: https://github.com/torvalds/linux/commit/edf410cb74dc612fd47ef5be319c5a0bcd6e6ccd
Other sources
A NULL pointer dereference flaw was found in vmxnet3rqcleanup in drivers/net/vmxnet3/vmxnet3drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 5.18 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch edf410cb74dc612fd47ef5be319c5a0bcd6e6ccd
Event History
Frequently Asked Questions
What is the severity of CVE-2023-4459?
CVE-2023-4459 has been rated as a medium severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2023-4459?
To fix CVE-2023-4459, upgrade to the recommended kernel versions specified for your distribution.
Who is affected by CVE-2023-4459?
CVE-2023-4459 affects users of specific Linux kernels including those on Red Hat and Debian systems.
What type of vulnerability is CVE-2023-4459?
CVE-2023-4459 is classified as a NULL pointer dereference vulnerability.
Can CVE-2023-4459 be exploited by non-privileged users?
Yes, CVE-2023-4459 can potentially be exploited by local attackers with normal user privileges.