CVE-2023-2166: Null Pointer Dereference
A null pointer dereference issue was found in can protocol in net/can/afcan.c in the Linux before Linux. mlpriv may not be initialized in the receive path of CAN frames. A local user could use this flaw to crash the system or potentially cause a denial of service.
Other sources
Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference flaw in can protocol in net/can/afcan.c. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause the system to crash.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2166?
CVE-2023-2166 has a medium severity rating due to its potential to crash the system or cause a denial of service.
How do I fix CVE-2023-2166?
To fix CVE-2023-2166, update the Linux kernel to version 6.1 or later.
Who is affected by CVE-2023-2166?
CVE-2023-2166 affects users running Linux kernel versions prior to 6.1, as well as certain versions of IBM Security Verify Governance software.
What causes the vulnerability in CVE-2023-2166?
CVE-2023-2166 is caused by a null pointer dereference in the CAN protocol implementation in the Linux kernel.
Can CVE-2023-2166 be exploited remotely?
CVE-2023-2166 requires local access to exploit, as it involves a flaw in the kernel's CAN frame processing.