Bugzilla – Bug 1212608
VUL-0: CVE-2023-3359: kernel-source,kernel-source-azure,kernel-source-rt: NULL Pointer Dereference in drivers/nvmem/brcm_nvram.c
Last modified: 2023-06-23 07:31:23 UTC
CVE-2023-3359 An issue was discovered in the Linux kernel through 6.1-rc8. brcm_nvram_parse in drivers/nvmem/brcm_nvram.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference. Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0576ade3aaf24b376ea1a4406ae138e2a22b0c0 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3359 https://bugzilla.redhat.com/show_bug.cgi?id=2168251
Fixing commit: https://github.com/torvalds/linux/commit/b0576ade3aaf24b376ea1a4406ae138e2a22b0c0 Commit introducing the issue: https://github.com/torvalds/linux/commit/6e977eaa8280e957b87904b536661550f2a6b3e8 Not affected (already contains fix): - ALP-current - stable Not affected (does not contain introducing commit): - SLE12-SP5 - cve/linux-4.12 - cve/linux-5.3 - cve/linux-3.0 - cve/linux-4.4 - SLE15-SP4-AZURE - SLE15-SP4-RT - SLE15-SP4 - SLE15-SP5 - SLE15-SP5-AZURE - SLE15-SP5-RT
(In reply to Hu from comment #1) > Fixing commit: > https://github.com/torvalds/linux/commit/ > b0576ade3aaf24b376ea1a4406ae138e2a22b0c0 > > Commit introducing the issue: > https://github.com/torvalds/linux/commit/ > 6e977eaa8280e957b87904b536661550f2a6b3e8 > > Not affected (already contains fix): > - ALP-current > - stable > > Not affected (does not contain introducing commit): > - SLE12-SP5 > - cve/linux-4.12 > - cve/linux-5.3 > - cve/linux-3.0 > - cve/linux-4.4 > - SLE15-SP4-AZURE > - SLE15-SP4-RT > - SLE15-SP4 > - SLE15-SP5 > - SLE15-SP5-AZURE > - SLE15-SP5-RT Looks that we don't need do anything. reset assigner.
closing