In the Linux kernel, the following vulnerability has been resolved:
firmware: dmi-sysfs: Fix null-ptr-deref in dmisysfsregister_handle
KASAN reported a null-ptr-deref error:
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 1373 Comm: modprobe Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:dmisysfsentryrelease ... Call Trace: <TASK> kobjectput dmisysfsregisterhandle (drivers/firmware/dmi-sysfs.c:540) dmisysfs dmidecodetable (drivers/firmware/dmiscan.c:133) dmiwalk (drivers/firmware/dmiscan.c:1115) dmisysfsinit (drivers/firmware/dmi-sysfs.c:149) dmisysfs dooneinitcall (init/main.c:1296) ... Kernel panic - not syncing: Fatal exception Kernel Offset: 0x4000000 from 0xffffffff81000000 ---[ end Kernel panic - not syncing: Fatal exception ]---
It is because previous patch added kobjectput() to release the memory which will call dmisysfsentryrelease() and list_del().
However, listaddtail(entry->list) is called after the error block, so the list_head is uninitialized and cannot be deleted.
Move error handling to after listaddtail to fix this.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d0492d1d934642bdfd2057acc1b56f4b57be465",
"target": {
"file": "drivers/firmware/dmi-sysfs.c"
},
"digest": {
"line_hashes": [
"214729683308946596285071604643277545173",
"65588185247792519711423931046870162808",
"298890920256309810184934656938537606956",
"108056585142857819905033256065112314676",
"273793033234934361896232658154343035567",
"303079314480045275125012749687354009085",
"336617293583289880426933033892873813666",
"263452454391370693414120605265925727819",
"262247375355467652855274299098730677620",
"307887284529943636208160064619445173982"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2023-53250-320abb93",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18e126e97c961f7a93823795c879d7c085fe5098",
"target": {
"file": "drivers/firmware/dmi-sysfs.c"
},
"digest": {
"line_hashes": [
"214729683308946596285071604643277545173",
"65588185247792519711423931046870162808",
"298890920256309810184934656938537606956",
"108056585142857819905033256065112314676",
"273793033234934361896232658154343035567",
"303079314480045275125012749687354009085",
"336617293583289880426933033892873813666",
"263452454391370693414120605265925727819",
"262247375355467652855274299098730677620",
"307887284529943636208160064619445173982"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2023-53250-37f5f8cc",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e851996b32264e78a10863c2ac41a8689d7b9252",
"target": {
"function": "dmi_sysfs_register_handle",
"file": "drivers/firmware/dmi-sysfs.c"
},
"digest": {
"function_hash": "312486309494524354221462693277557379465",
"length": 1001.0
},
"deprecated": false,
"id": "CVE-2023-53250-43b86f5c",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d0492d1d934642bdfd2057acc1b56f4b57be465",
"target": {
"function": "dmi_sysfs_register_handle",
"file": "drivers/firmware/dmi-sysfs.c"
},
"digest": {
"function_hash": "312486309494524354221462693277557379465",
"length": 1001.0
},
"deprecated": false,
"id": "CVE-2023-53250-639f2394",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18e126e97c961f7a93823795c879d7c085fe5098",
"target": {
"function": "dmi_sysfs_register_handle",
"file": "drivers/firmware/dmi-sysfs.c"
},
"digest": {
"function_hash": "312486309494524354221462693277557379465",
"length": 1001.0
},
"deprecated": false,
"id": "CVE-2023-53250-91f7cb77",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4fe158259fb5fead52ff2b55841ec5c39492604",
"target": {
"file": "drivers/firmware/dmi-sysfs.c"
},
"digest": {
"line_hashes": [
"214729683308946596285071604643277545173",
"65588185247792519711423931046870162808",
"298890920256309810184934656938537606956",
"108056585142857819905033256065112314676",
"273793033234934361896232658154343035567",
"303079314480045275125012749687354009085",
"336617293583289880426933033892873813666",
"263452454391370693414120605265925727819",
"262247375355467652855274299098730677620",
"307887284529943636208160064619445173982"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2023-53250-a76ec4ce",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e851996b32264e78a10863c2ac41a8689d7b9252",
"target": {
"file": "drivers/firmware/dmi-sysfs.c"
},
"digest": {
"line_hashes": [
"214729683308946596285071604643277545173",
"65588185247792519711423931046870162808",
"298890920256309810184934656938537606956",
"108056585142857819905033256065112314676",
"273793033234934361896232658154343035567",
"303079314480045275125012749687354009085",
"336617293583289880426933033892873813666",
"263452454391370693414120605265925727819",
"262247375355467652855274299098730677620",
"307887284529943636208160064619445173982"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2023-53250-c36e0753",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4fe158259fb5fead52ff2b55841ec5c39492604",
"target": {
"function": "dmi_sysfs_register_handle",
"file": "drivers/firmware/dmi-sysfs.c"
},
"digest": {
"function_hash": "312486309494524354221462693277557379465",
"length": 1001.0
},
"deprecated": false,
"id": "CVE-2023-53250-e0e11d24",
"signature_version": "v1",
"signature_type": "Function"
}
]