NetSight
IP …
medium5.5

CVE-2023-52893

In the Linux kernel, the following vulnerability has been resolved: gsmi: fix null-deref in gsmi_get_variable We can get EFI variables without fetching the att…

Impact

In the Linux kernel, the following vulnerability has been resolved: gsmi: fix null-deref in gsmi_get_variable We can get EFI variables without fetching the attribute, so we must allow for that in gsmi. commit 859748255b43 ("efi: pstore: Omit efivars caching EFI varstore access layer") added a new get_variable call with attr=NULL, which triggers panic in gsmi.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 3.0 before 4.14.304
from 4.15 before 4.19.271
from 4.20 before 5.4.230
from 5.5 before 5.10.165
from 5.11 before 5.15.90
from 5.16 before 6.1.8

Weakness classification

CWE-476

References