CVE-2024-53233: unicode: Fix utf8_load() error path
In the Linux kernel, the following vulnerability has been resolved:
unicode: Fix utf8load() error path
utf8load() requests the symbol "utf8datatable" and then checks if the requested UTF-8 version is supported. If it's unsupported, it tries to put the data table using symbolput(). If an unsupported version is requested, symbolput() fails like this:
kernel BUG at kernel/module/main.c:786! RIP: 0010:symbolput+0x93/0xb0 Call Trace: <TASK> ? diebody.cold+0x19/0x27 ? die+0x2e/0x50 ? dotrap+0xca/0x110 ? doerrortrap+0x65/0x80 ? symbolput+0x93/0xb0 ? excinvalidop+0x51/0x70 ? symbolput+0x93/0xb0 ? asmexcinvalidop+0x1a/0x20 ? pfxcmpname+0x10/0x10 ? symbolput+0x93/0xb0 ? symbolput+0x62/0xb0 utf8load+0xf8/0x150
That happens because symbolput() expects the unique string that identify the symbol, instead of a pointer to the loaded symbol. Fix that by using such string.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53233?
CVE-2024-53233 has a medium severity rating, as it impacts the handling of unsupported UTF-8 versions in the Linux kernel.
How do I fix CVE-2024-53233?
To fix CVE-2024-53233, update to the patched versions of the Linux kernel, specifically 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.15-1.
Which Linux kernel versions are affected by CVE-2024-53233?
CVE-2024-53233 affects various versions of the Linux kernel prior to the specified patched releases.
What components are involved in CVE-2024-53233?
CVE-2024-53233 involves the unicode handling within the Linux kernel, particularly the utf8_load() function.
Is CVE-2024-53233 exploitable remotely?
CVE-2024-53233 does not appear to be directly exploitable remotely, but could lead to potential local attacks if not mitigated.