CVE-2023-1382: Null Pointer Dereference
A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel.
Other sources
A data race happens between con is allocated and con->sock is set, leading to null pointer dereference when accessing con->sock->sk. The null pointer dereference issue was found in tipc protocol in net/tipc/topsrv.c in Linux before 6.0.
Reference: https://lore.kernel.org/netdev/bc7bd3183f1c275c820690fc65b708238fe9e38e.1668807842.git.lucien.xin@gmail.com/T/#u
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference flaw when accessing con->sock->sk in net/tipc/topsrv.c in the tipc protocol. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause the system to crash.
— IBM
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2023-1382?
CVE-2023-1382 has been classified as a medium severity vulnerability.
How do I fix CVE-2023-1382?
To mitigate CVE-2023-1382, upgrade to kernel version 0:5.14.0-284.11.1.el9_2 or apply other specified patches.
Which systems are affected by CVE-2023-1382?
CVE-2023-1382 affects various Linux kernel versions including 5.14 and 6.1, as well as specific IBM Security products.
What type of vulnerability is CVE-2023-1382?
CVE-2023-1382 is a data race flaw in the Linux kernel affecting the tipc protocol.
What is the impact of CVE-2023-1382?
The impact of CVE-2023-1382 is a potential NULL pointer dereference that could lead to system instability.