5.5

CVE-2023-52567

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250_port: Check IRQ data before use

In case the leaf driver wants to use IRQ polling (irq = 0) and
IIR register shows that an interrupt happened in the 8250 hardware
the IRQ data can be NULL. In such a case we need to skip the wake
event as we came to this path from the timer interrupt and quite
likely system is already awake.

Without this fix we have got an Oops:

    serial8250: ttyS0 at I/O 0x3f8 (irq = 0, base_baud = 115200) is a 16550A
    ...
    BUG: kernel NULL pointer dereference, address: 0000000000000010
    RIP: 0010:serial8250_handle_irq+0x7c/0x240
    Call Trace:
     ? serial8250_handle_irq+0x7c/0x240
     ? __pfx_serial8250_timeout+0x10/0x10
Data is provided by the National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.14.315 < 4.14.327
Linux ≫ Linux Kernel Version >= 4.19.283 < 4.19.296
Linux ≫ Linux Kernel Version >= 5.4.243 < 5.4.258
Linux ≫ Linux Kernel Version >= 5.10.180 < 5.10.198
Linux ≫ Linux Kernel Version >= 5.15.111 < 5.15.134
Linux ≫ Linux Kernel Version >= 6.1.28 < 6.1.56
Linux ≫ Linux Kernel Version >= 6.4 < 6.5.6
Linux ≫ Linux Kernel Version6.6 Updaterc1
Linux ≫ Linux Kernel Version6.6 Updaterc2
Linux ≫ Linux Kernel Version6.6 Updaterc3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.01% 0.011
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.