CVE-2023-52570

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vfio/mdev: Fix a null-ptr-deref bug for mdev_unregister_parent()

Inject fault while probing mdpy.ko, if kstrdup() of create_dir() fails in

kobject_add_internal() in kobject_init_and_add() in mdev_type_add()

in parent_create_sysfs_files(), it will return 0 and probe successfully.

And when rmmod mdpy.ko, the mdpy_dev_exit() will call

mdev_unregister_parent(), the mdev_type_remove() may traverse uninitialized

parent->types[i] in parent_remove_sysfs_files(), and it will cause

below null-ptr-deref.

If mdev_type_add() fails, return the error code and kset_unregister()

to fix the issue.

general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN

KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]

CPU: 2 PID: 10215 Comm: rmmod Tainted: G W N 6.6.0-rc2+ #20

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014

RI

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References