发布于3月6日3月6日 Members Debian: CVE-2023-52877: linux -- security update Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 05/21/2024 Created 07/31/2024 Added 07/30/2024 Modified 01/28/2025 Description In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() It is possible that typec_register_partner() returns ERR_PTR on failure. When port->partner is an error, a NULL pointer dereference may occur as shown below. [91222.095236][T319] typec port0: failed to register partner (-17) ... [91225.061491][T319] Unable to handle kernel NULL pointer dereference at virtual address 000000000000039f [91225.274642][T319] pc : tcpm_pd_data_request+0x310/0x13fc [91225.274646][T319] lr : tcpm_pd_data_request+0x298/0x13fc [91225.308067][T319] Call trace: [91225.308070][T319]tcpm_pd_data_request+0x310/0x13fc [91225.308073][T319]tcpm_pd_rx_handler+0x100/0x9e8 [91225.355900][T319]kthread_worker_fn+0x178/0x58c [91225.355902][T319]kthread+0x150/0x200 [91225.355905][T319]ret_from_fork+0x10/0x30 Add a check for port->partner to avoid dereferencing a NULL pointer. Solution(s) debian-upgrade-linux References https://attackerkb.com/topics/cve-2023-52877 CVE - 2023-52877
