CVE-2023-54087
In the Linux kernel, the following vulnerability has been resolved: ubi: Fix possible null-ptr-deref in ubi_free_volume() It willl cause null-ptr-deref in the following case: uif_init() ubi_add_volume() cdev_add() -> if it fails, call kill_volumes() device_register() kill_volumes() -> if ubi_add_volume() fails call this function ubi_free_volume() cdev_del() device_unregister() -> trying to delete a not added device, it causes null-ptr-deref So in ubi_free_volume(), it delete devices whether they are added or not, it will causes null-ptr-deref. Handle the error case whlie calling ubi_add_volume() to fix this problem. If add volume fails, set the corresponding vol to null, so it can not be accessed in kill_volumes() and release the resource in ubi_add_volume() error path.
Affected versions
Linux kernel versions
2.6.22
and later are affected. Fixed in
4.14.308,
4.19.276,
5.4.235,
5.10.173,
5.15.100,
6.1.18,
6.2.5,
6.3
and their respective stable series.
References
The following references provide additional information about CVE-2023-54087 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/234c53e57424992e657e6f4acc00d3df0983176f
-
PatchKernel patch commithttps://git.kernel.org/stable/c/2ea7195b195009ecf0046e55361f393ba96d02db
-
PatchKernel patch commithttps://git.kernel.org/stable/c/45b2c5ca4d2edae70f19fdb086bd927840c4c309
Frequently asked questions
-
What is CVE-2023-54087?
CVE-2023-54087 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.22 onward and has been patched in 4.14.308, 4.19.276, 5.4.235 and others. CVE-2023-54087 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2023-54087?
Yes — CVE-2023-54087 has been patched. Fixed versions include 4.14.308, 4.19.276, 5.4.235 and others. If you are running Linux kernel 2.6.22 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2023-54087 actively exploited?
No — CVE-2023-54087 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.