Log in Start free

Vulnerability · Published Mar 2, 2024 · Assigned by Linux

CVE-2023-52508nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid()

Medium 5.5

In plain English

A medium-severity null pointer dereference in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 86.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() The nvme_fc_fcp_op structure describing an AEN operation is initialized with a null request structure pointer. An FC LLDD may make a call to nvme_fc_io_getuuid passing a pointer to an nvmefc_fcp_req for an AEN operation. Add validation of the request structure pointer before dereference.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.64-1DEBIAN-CVE-2023-52508
Debian:13linux6.5.6-1DEBIAN-CVE-2023-52508
Debian:14linux6.5.6-1DEBIAN-CVE-2023-52508
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-nvidia-6.56.5.0-1014.14UBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2023-52508
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2023-52508
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2023-52508

Affected products (as reported)

VendorProductVersions
Linux Linux 827fc630e4c8087df5a8e8ee013b686bd6f13736 – before be90c9e29dd59b7d19a73297a1590ff3ec1d22ea827fc630e4c8087df5a8e8ee013b686bd6f13736 – before dd46b3ac7322baf3772b33b29726e94f98289db7827fc630e4c8087df5a8e8ee013b686bd6f13736 – before 8ae5b3a685dc59a8cf7ccfe0e850999ba9727a3c7a41fdf27a4b1ee565ce5bf3e409b2df0b8514c45.18.18 – before 5.19
Linux Linux 5.19

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References