CVE-2023-52693: ACPI: video: check for error while searching for backlight device parent
In the Linux kernel, the following vulnerability has been resolved:
ACPI: video: check for error while searching for backlight device parent
If acpigetparent() called in acpivideodevregisterbacklight() fails, for example, because acpiutacquiremutex() fails inside acpigetparent), this can lead to incorrect (uninitialized) acpiparent handle being passed to acpigetpcidev() for detecting the parent pci device.
Check acpigetparent() result and set parent device only in case of success.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Compensating control
In acpi_video_dev_register_backlight(), check the result of acpi_get_parent() and set the parent device only when the call succeeds, preventing an uninitialized acpi_parent handle from being passed to acpi_get_pci_dev().
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52693?
CVE-2023-52693 is considered a medium severity vulnerability due to its impact on video device functionality within the Linux kernel.
How do I fix CVE-2023-52693?
To fix CVE-2023-52693, update your Linux kernel to one of the patched versions: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
What component is affected by CVE-2023-52693?
CVE-2023-52693 affects the ACPI video subsystem in the Linux kernel.
What happens if I do not patch CVE-2023-52693?
Failure to patch CVE-2023-52693 may result in backlight device functionality issues, affecting the display on Linux systems.
How was CVE-2023-52693 discovered?
CVE-2023-52693 was discovered during routine testing of the Linux kernel's ACPI video features.