CVE-2023-52652: NTB: fix possible name leak in ntb_register_device()
In the Linux kernel, the following vulnerability has been resolved:
NTB: fix possible name leak in ntbregisterdevice()
If deviceregister() fails in ntbregisterdevice(), the device name allocated by devsetname() should be freed. As per the comment in deviceregister(), callers should use putdevice() to give up the reference in the error path. So fix this by calling putdevice() in the error path so that the name can be freed in kobjectcleanup().
As a result of this, putdevice() in the error path of ntbregisterdevice() is removed and the actual error is returned.
[mani: reworded commit message]
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52652?
CVE-2023-52652 has a medium severity rating due to its potential to disclose device names.
How do I fix CVE-2023-52652?
To fix CVE-2023-52652, you should upgrade to the latest kernel version that includes the resolution.
What software is affected by CVE-2023-52652?
CVE-2023-52652 affects specific versions of the Linux kernel, particularly those prior to 5.10.223-1 and including various Debian packages.
What is the impact of CVE-2023-52652?
The impact of CVE-2023-52652 is a potential name leak in ntb_register_device() that could expose sensitive information.
When was CVE-2023-52652 disclosed?
CVE-2023-52652 was disclosed alongside fixes in the Linux kernel for vulnerabilities related to device registration.