CVE-2023-52893

Published: Aug 21, 2024Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

In the Linux kernel, the following vulnerability has been resolved: gsmi: fix null-deref in gsmi_get_variable We can get EFI variables without fetching the attribute, so we must allow for that in gsmi. commit 859748255b43 ("efi: pstore: Omit efivars caching EFI varstore access layer") added a new get_variable call with attr=NULL, which triggers panic in gsmi.

Affected (10)

Products: Linux: Linux Kernel

Linux

1 product

Linux Kernel

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	From 3.0 to 4.14.304
Linux Linux Kernel	From 4.15 to 4.19.271
Linux Linux Kernel	From 4.20 to 5.4.230
Linux Linux Kernel	From 5.11 to 5.15.90
Linux Linux Kernel	From 5.16 to 6.1.8
Linux Linux Kernel	From 5.5 to 5.10.165
Linux Linux Kernel	Version 6.2 rc1
Linux Linux Kernel	Version 6.2 rc2
Linux Linux Kernel	Version 6.2 rc3
Linux Linux Kernel	Version 6.2 rc4