In the Linux kernel, the following vulnerability has been resolved:
md/raid10: fix null-ptr-deref of mreplace in raid10syncrequest
There are two check of 'mreplace' in raid10syncrequest(). In the first check, 'needreplace' will be set and 'mreplace' will be used later if no-Faulty 'mreplace' exists, In the second check, 'mreplace' will be set to NULL if it is Faulty, but 'needreplace' will not be changed accordingly. null-ptr-deref occurs if Faulty is set between two check.
Fix it by merging two checks into one. And replace 'need_replace' with 'mreplace' because their values are always the same.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53380.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53380.json"
[
{
"id": "CVE-2023-53380-07272730",
"signature_type": "Line",
"digest": {
"line_hashes": [
"156957426122046457756954579477054502213",
"13135402058391126505489777565247251535",
"242955594639693412643074532899281393570",
"267045927386902378358849151114096267086",
"18752715061258710822020732517001429679",
"51100446137839737759637102422004682052",
"265783112221204951640119731589659741405",
"165190274071215536630337328372276429514",
"75922767084781907931479701858899081821",
"170561218420587927559599679624409261590",
"164170210596053214010597313435909325296",
"157216342276858233249506673252386757126",
"166881686353443853551916350770082578218",
"169319605184864584085315889452182617076",
"64164003163259396477171848571492545487",
"183107959611875323271935484729827184826",
"100420480302755175431865328189373490898",
"30417759353405219265409193522908310981",
"306355478934655130051597653530667463934",
"239006144500811610234651308243180892471"
],
"threshold": 0.9
},
"target": {
"file": "drivers/md/raid10.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@222cc459d59857ee28a5366dc225ab42b22f9272",
"signature_version": "v1",
"deprecated": false
},
{
"id": "CVE-2023-53380-09cbafdc",
"signature_type": "Function",
"digest": {
"function_hash": "286871225768561982223794451453018423185",
"length": 11593.0
},
"target": {
"file": "drivers/md/raid10.c",
"function": "raid10_sync_request"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@222cc459d59857ee28a5366dc225ab42b22f9272",
"signature_version": "v1",
"deprecated": false
}
]