CVE-2023-6915: Kernel: null pointer dereference vulnerability in ida_free in lib/idr.c
A Null pointer de-reference problem was found in idafree in lib/idr.c file when it calls the xasload function and returns a null value, assigning NULL to the bitmap variable.
Therefore, if (xaisvalue(bitmap)) will fail and jump to the else branch. However, in the else branch, the statement if (!testbit(bit, bitmap->bitmap)) references the member of bitmap, which triggers a null pointer dereference vulnerability.
Reference: https://github.com/torvalds/linux/commit/af73483f4e8b6f5c68c9aa63257bdd929a9c194a
Other sources
A Null pointer dereference problem was found in idafree in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return.
— Launchpad
Kernel: null pointer dereference vulnerability in idafree in lib/idr.c
— Microsoft
Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference flaw in the idafree function in lib/idr.c. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6915?
CVE-2023-6915 has a high severity due to its potential for causing system crashes through a null pointer dereference.
How do I fix CVE-2023-6915?
To fix CVE-2023-6915, update the Linux Kernel to a version that includes patches, such as those released after 6.7.
What software is affected by CVE-2023-6915?
CVE-2023-6915 affects several versions of the Linux Kernel and specific Red Hat Enterprise Linux versions.
What are the potential impacts of CVE-2023-6915?
Exploitation of CVE-2023-6915 could lead to denial of service by crashing the affected system.
Is there a workaround for CVE-2023-6915?
There are no known workarounds for CVE-2023-6915, so it is recommended to apply security updates promptly.