CVE-2023-52520: platform/x86: think-lmi: Fix reference leak
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: think-lmi: Fix reference leak
If a duplicate attribute is found using ksetfindobj(), a reference to that attribute is returned which needs to be disposed accordingly using kobjectput(). Move the setting name validation into a separate function to allow for this change without having to duplicate the cleanup code for this setting. As a side note, a very similar bug was fixed in commit 7295a996fdab ("platform/x86: dell-sysman: Fix reference leak"), so it seems that the bug was copied from that driver.
Compile-tested only.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: think-lmi: Fix reference leak
The Linux kernel CVE team has assigned CVE-2023-52520 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024030252-CVE-2023-52520-0a4e@gregkh/T/#u
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by a reference leak. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What are the affected versions for CVE-2023-52520?
CVE-2023-52520 affects Linux kernel versions between 5.14 and 5.15.136, 5.16 and 6.1.59, 6.2 and 6.5.8, and includes versions 6.6 and its release candidates.
What is the severity of CVE-2023-52520?
The severity of CVE-2023-52520 is classified as moderate, as it involves a reference leak that could affect the stability of the system.
How do I fix CVE-2023-52520?
To fix CVE-2023-52520, upgrade to Linux kernel version 5.15.136, 6.1.59, 6.5.8, or 6.6.
What type of vulnerability is CVE-2023-52520?
CVE-2023-52520 is categorized as a reference leak vulnerability in the Linux kernel.
Can CVE-2023-52520 be exploited by remote attackers?
CVE-2023-52520 does not present a direct remote exploitation vector, as it primarily affects local system stability.