5.5

CVE-2023-53055

fscrypt: destroy keyring after security_sb_delete()

In the Linux kernel, the following vulnerability has been resolved:

fscrypt: destroy keyring after security_sb_delete()

fscrypt_destroy_keyring() must be called after all potentially-encrypted
inodes were evicted; otherwise it cannot safely destroy the keyring.
Since inodes that are in-use by the Landlock LSM don't get evicted until
security_sb_delete(), this means that fscrypt_destroy_keyring() must be
called *after* security_sb_delete().

This fixes a WARN_ON followed by a NULL dereference, only possible if
Landlock was being used on encrypted files.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.10.154 < 5.11
Linux ≫ Linux Kernel Version >= 5.15.78 < 5.15.105
Linux ≫ Linux Kernel Version >= 6.0.8 < 6.1.22
Linux ≫ Linux Kernel Version >= 6.2 < 6.2.9
Linux ≫ Linux Kernel Version6.3 Updaterc1
Linux ≫ Linux Kernel Version6.3 Updaterc2
Linux ≫ Linux Kernel Version6.3 Updaterc3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.061
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

https://git.kernel.org/stable/c/992a3f3e8a0c92151dfdf65fc85567c865fd558a
Patch
https://git.kernel.org/stable/c/d77531fac6a1fd9f1db0195438ba5419d72b96c4
Patch
https://git.kernel.org/stable/c/497ab5d9c7852dfedab2c9de75e41b60e54b7c5d
Patch
https://git.kernel.org/stable/c/ccb820dc7d2236b1af0d54ae038a27b5b6d5ae5a
Patch