A NULL pointer dereference was found in iofilebitmapget in iouring/filetable.c in the iouring sub-component in the Linux Kernel. When fixed files are unregistered, some context information (filealloc{start,end} and allochint) is not cleared. A subsequent request that has auto index selection enabled via IORINGFILEINDEX_ALLOC can cause a NULL pointer dereference. An unprivileged user can use the flaw to cause a system crash.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1583.json"
[
{
"id": "CVE-2023-1583-0accfb21",
"target": {
"file": "io_uring/filetable.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@02a4d923e4400a36d340ea12d8058f69ebf3a383",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338095107549366544426189226412253099878",
"126063947880568096789111981075121084495",
"75602871834500969116842241566995602465"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-1583-7f0522d4",
"target": {
"function": "__io_sqe_files_unregister",
"file": "io_uring/rsrc.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@02a4d923e4400a36d340ea12d8058f69ebf3a383",
"digest": {
"function_hash": "171351599972887228268952870421122899393",
"length": 604.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-1583-9dc219ff",
"target": {
"file": "io_uring/rsrc.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@02a4d923e4400a36d340ea12d8058f69ebf3a383",
"digest": {
"threshold": 0.9,
"line_hashes": [
"6926969011255966425648993245430567748",
"826795262950998500360445420676180092",
"25455114730771562150647988697852434669",
"250122478662887603736030918182275426594"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-1583-e685d77a",
"target": {
"function": "io_file_bitmap_get",
"file": "io_uring/filetable.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@02a4d923e4400a36d340ea12d8058f69ebf3a383",
"digest": {
"function_hash": "135803019988768517124821240843639643101",
"length": 407.0
},
"signature_type": "Function"
}
]