In the Linux kernel, the following vulnerability has been resolved:
genirq/ipi: Fix NULL pointer deref in irqdatagetaffinitymask()
If ipisend{mask|single}() is called with an invalid interrupt number, all the local variables there will be NULL. ipisendverify() which is invoked from these functions does verify its 'data' parameter, resulting in a kernel oops in irqdatagetaffinitymask() as the passed NULL pointer gets dereferenced.
Add a missing NULL pointer check in ipisendverify()...
Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.
{ "vanir_signatures": [ { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7448c73d64075051f50caed2c62f46553b69ab8a", "deprecated": false, "id": "CVE-2023-53332-299dd54a", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "10671342672986462575012605616649212476", "338348849271926039097869621456091433482", "267633414726886697282992268671453451247", "240852056106701338525880375535452733305", "172188229293862643186705121015344474800", "280681095029075750467507965720449272491", "189693180864319005511669862130925506342", "252239143648488942078519743773908743104" ] }, "target": { "file": "kernel/irq/ipi.c" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@feabecaff5902f896531dde90646ca5dfa9d4f7d", "deprecated": false, "id": "CVE-2023-53332-70e3b5cf", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "10671342672986462575012605616649212476", "338348849271926039097869621456091433482", "267633414726886697282992268671453451247", "240852056106701338525880375535452733305", "172188229293862643186705121015344474800", "280681095029075750467507965720449272491", "189693180864319005511669862130925506342", "252239143648488942078519743773908743104" ] }, "target": { "file": "kernel/irq/ipi.c" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@926aef60ea64cd9becf2829f7388f48dbe8bcb11", "deprecated": false, "id": "CVE-2023-53332-8a862c2d", "signature_type": "Function", "digest": { "length": 453.0, "function_hash": "63709129130110325499728775278566914926" }, "target": { "file": "kernel/irq/ipi.c", "function": "ipi_send_verify" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@926aef60ea64cd9becf2829f7388f48dbe8bcb11", "deprecated": false, "id": "CVE-2023-53332-9bea2f05", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "10671342672986462575012605616649212476", "338348849271926039097869621456091433482", "267633414726886697282992268671453451247", "240852056106701338525880375535452733305", "172188229293862643186705121015344474800", "280681095029075750467507965720449272491", "189693180864319005511669862130925506342", "252239143648488942078519743773908743104" ] }, "target": { "file": "kernel/irq/ipi.c" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@feabecaff5902f896531dde90646ca5dfa9d4f7d", "deprecated": false, "id": "CVE-2023-53332-b64555e6", "signature_type": "Function", "digest": { "length": 453.0, "function_hash": "63709129130110325499728775278566914926" }, "target": { "file": "kernel/irq/ipi.c", "function": "ipi_send_verify" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7448c73d64075051f50caed2c62f46553b69ab8a", "deprecated": false, "id": "CVE-2023-53332-cd8a351c", "signature_type": "Function", "digest": { "length": 453.0, "function_hash": "63709129130110325499728775278566914926" }, "target": { "file": "kernel/irq/ipi.c", "function": "ipi_send_verify" } } ] }