CVE-2023-3212: Null Pointer Dereference
A flaw in the Linux Kernel found in the GFS2 file system. On corrupted gfs2 file systems the evict code can try to reference the journal descriptor structure, jdesc, after it has been freed and set to NULL. It can lead to null pointer dereference when gfs2transbegin being called and then fail ingfs2evictinode().
Reference: https://listman.redhat.com/archives/cluster-devel/2023-April/023914.html
Other sources
A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.
— Launchpad
Linux Kernel is vulnerable to a denial of service, caused by NULL pointer dereference issue in the gfs2 file system. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a kernel panic.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.4
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3212?
CVE-2023-3212 is classified as a high severity vulnerability that can lead to a system crash due to a null pointer dereference.
How do I fix CVE-2023-3212?
To fix CVE-2023-3212, upgrade to the latest kernel version as specified in vendor advisories.
Which systems are affected by CVE-2023-3212?
CVE-2023-3212 affects various Linux distributions, including Red Hat, Fedora, and Debian up to specific versions.
Is there a patch available for CVE-2023-3212?
Yes, patches for CVE-2023-3212 are included in the kernel updates provided by affected Linux distributions.
What are the consequences of exploiting CVE-2023-3212?
Exploitation of CVE-2023-3212 can lead to a null pointer dereference, potentially causing system instability or crashes.