CVE-2023-52984

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52984
In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices The probe() function is only used for the DP83822 PHY, leaving the private data pointer uninitialized for the smaller DP83825/26 models. While all uses of the private data structure are hidden in 82822 specific callbacks, configuring the interrupt is shared across all models. This causes a NULL pointer dereference on the smaller PHYs as it accesses the private data unchecked. Verifying the pointer avoids that.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2cd1e9c013ec56421c58921b1ddf1d2d53bd47fa Patch
https://git.kernel.org/stable/c/362a2f5531dc0e5b0b5b3e3a541000dbffa75461 Patch
https://git.kernel.org/stable/c/422ae7d9c7221e8d4c8526d0f54106307d69d2dc Patch
https://git.kernel.org/stable/c/78901b10522cdf6badf24acf65a892637596bccc Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc6:*:*:*:*:*:*
History

15 Apr 2025, 14:14

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CWE CWE-476
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: phy: dp83822: Se corrige el acceso a puntero nulo en dispositivos DP83825/DP83826. La función probe() solo se utiliza para la estructura física (PHY) DP83822, lo que deja el puntero de datos privados sin inicializar para los modelos DP83825/26 más pequeños. Si bien todos los usos de la estructura de datos privados están ocultos en las devoluciones de llamada específicas de 82822, la configuración de la interrupción se comparte entre todos los modelos. Esto provoca una desreferencia de puntero nulo en las estructuras físicas (PHY) más pequeñas, ya que accede a los datos privados sin verificar. Verificar el puntero evita esto.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/2cd1e9c013ec56421c58921b1ddf1d2d53bd47fa - () https://git.kernel.org/stable/c/2cd1e9c013ec56421c58921b1ddf1d2d53bd47fa - Patch
References () https://git.kernel.org/stable/c/362a2f5531dc0e5b0b5b3e3a541000dbffa75461 - () https://git.kernel.org/stable/c/362a2f5531dc0e5b0b5b3e3a541000dbffa75461 - Patch
References () https://git.kernel.org/stable/c/422ae7d9c7221e8d4c8526d0f54106307d69d2dc - () https://git.kernel.org/stable/c/422ae7d9c7221e8d4c8526d0f54106307d69d2dc - Patch
References () https://git.kernel.org/stable/c/78901b10522cdf6badf24acf65a892637596bccc - () https://git.kernel.org/stable/c/78901b10522cdf6badf24acf65a892637596bccc - Patch

27 Mar 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-27 17:15

Updated : 2025-04-15 14:14

NVD link : CVE-2023-52984

Mitre link : CVE-2023-52984

CVE.ORG link : CVE-2023-52984

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference