In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()

It is possible that typec_register_partner() returns ERR_PTR on failure.
When port->partner is an error, a NULL pointer dereference may occur as
shown below.

[91222.095236][ T319] typec port0: failed to register partner (-17)
...
[91225.061491][ T319] Unable to handle kernel NULL pointer dereference
at virtual address 000000000000039f
[91225.274642][ T319] pc : tcpm_pd_data_request+0x310/0x13fc
[91225.274646][ T319] lr : tcpm_pd_data_request+0x298/0x13fc
[91225.308067][ T319] Call trace:
[91225.308070][ T319] tcpm_pd_data_request+0x310/0x13fc
[91225.308073][ T319] tcpm_pd_rx_handler+0x100/0x9e8
[91225.355900][ T319] kthread_worker_fn+0x178/0x58c
[91225.355902][ T319] kthread+0x150/0x200
[91225.355905][ T319] ret_from_fork+0x10/0x30

Add a check for port->partner to avoid dereferencing a NULL pointer.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00016.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
5e1d4c49fbc86dab6e005d66f066bd53c9479cde affected < e5f53a68a596e04df3fde3099273435a30b6fdac
5e1d4c49fbc86dab6e005d66f066bd53c9479cde affected < e7a802447c491903aa7cb45967aa2a934a4e63fc
5e1d4c49fbc86dab6e005d66f066bd53c9479cde affected < 9ee038590d808a95d16adf92818dcd4752273c08
5e1d4c49fbc86dab6e005d66f066bd53c9479cde affected < b37a168c0137156042a0ca9626651b5a789e822b
5e1d4c49fbc86dab6e005d66f066bd53c9479cde affected < 4987daf86c152ff882d51572d154ad12e4ff3a4b
Linux Linux affected
Version Status Constraints
5.12 affected —
0 unaffected < 5.12
5.15.138 unaffected ≤ 5.15.*
6.1.62 unaffected ≤ 6.1.*
6.5.11 unaffected ≤ 6.5.*
6.6.1 unaffected ≤ 6.6.*
6.7 unaffected ≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 8
kernel-rt-0:4.18.0-553.8.1.rt7.349.el8_10 cpe:/a:redhat:enterprise_linux:8::nfv RHSA-2024:4352 2024-07-08T00:00:00Z
kernel-0:4.18.0-553.8.1.el8_10 cpe:/o:redhat:enterprise_linux:8 RHSA-2024:4211 2024-07-02T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Redhat Subscribe
Enterprise Linux Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/4987daf86c152ff882d51572d154ad12e4ff3a4b cve-icon cve-icon
https://git.kernel.org/stable/c/9ee038590d808a95d16adf92818dcd4752273c08 cve-icon cve-icon
https://git.kernel.org/stable/c/b37a168c0137156042a0ca9626651b5a789e822b cve-icon cve-icon
https://git.kernel.org/stable/c/e5f53a68a596e04df3fde3099273435a30b6fdac cve-icon cve-icon
https://git.kernel.org/stable/c/e7a802447c491903aa7cb45967aa2a934a4e63fc cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024052122-CVE-2023-52877-0826@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-52877 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-52877 cve-icon
History

Mon, 06 Jan 2025 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Tue, 05 Nov 2024 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-05-04T07:44:59.559Z

Reserved: 2024-05-21T15:19:24.264Z

Link: CVE-2023-52877

cve-icon Vulnrichment

Updated: 2024-08-02T23:11:36.091Z

cve-icon NVD

Status : Analyzed

Published: 2024-05-21T16:15:24.377

Modified: 2025-01-06T20:32:18.993

Link: CVE-2023-52877

cve-icon Redhat

Severity : Low

Publid Date: 2024-05-21T00:00:00Z

Links: CVE-2023-52877 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses