CVE-2023-52616: crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
In the Linux kernel, the following vulnerability has been resolved:
crypto: lib/mpi - Fix unexpected pointer access in mpiecinit
When the mpiecctx structure is initialized, some fields are not cleared, causing a crash when referencing the field when the structure was released. Initially, this issue was ignored because memory for mpiecctx is allocated with the GFPZERO flag. For example, this error will be triggered when calculating the Za value for SM2 separately.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52616?
CVE-2023-52616 has been classified as a high severity vulnerability due to the risk of application crashes.
How do I fix CVE-2023-52616?
To fix CVE-2023-52616, upgrade to the patched versions of the Linux kernel, specifically 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.10-1, or 6.12.11-1.
What is affected by CVE-2023-52616?
CVE-2023-52616 affects the Linux kernel packages in specific versions that have not cleared certain fields in the mpi_ec_ctx structure.
What is the impact of CVE-2023-52616?
The impact of CVE-2023-52616 can lead to a system crash when referencing uninitialized fields after the structure's release.
Is CVE-2023-52616 exploitability high?
Yes, the exploitability of CVE-2023-52616 is considered high due to the likelihood of triggering application crashes.