CVE-2023-53292: blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none
blk-mq: fix NULL dereference on q->elevator in blkmqelvswitchnone
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.4.11-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.175 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.4.7 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Compensating control
After acquiring q->sysfs_lock, check whether q->elevator is NULL before dereferencing it in blk_mq_elv_switch_none.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53292?
CVE-2023-53292 has a high severity rating due to potential NULL dereference issues that can lead to system crashes.
How do I fix CVE-2023-53292?
To fix CVE-2023-53292, users should update the Linux kernel to version 6.4.7 or later.
What systems are affected by CVE-2023-53292?
CVE-2023-53292 affects the Linux kernel versions prior to 6.4.7 and the Microsoft cbl2 kernel 5.15.186.1-1.
What is the impact of CVE-2023-53292 on affected systems?
The impact of CVE-2023-53292 can result in system instability and potential crashes due to NULL dereference.
How was CVE-2023-53292 discovered?
CVE-2023-53292 was discovered during routine code review, highlighting a vulnerability in the blk-mq subsystem.