Bug 2254982 (CVE-2023-6915)

Summary: CVE-2023-6915 kernel: Null Pointer Dereference vulnerability in ida_free in lib/idr.c
Product: [Other] Security Response Reporter: Rohit Keshri <rkeshri>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, allarkin, aquini, bhu, chwhite, cye, cyin, dbohanno, ddutile, debarbos, dfreiber, drow, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, ldoskova, lgoncalv, llong, longman, lzampier, mmilgram, mstowell, nmurray, ptalbert, rogbas, rparrazo, rrobaina, rvrbovsk, rysulliv, scweaver, security-response-team, tglozar, tyberry, vcowan, vkumar, wcosta, williams, wmealing, ycote, ykopkova, zhijwang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2258419    
Bug Blocks: 2254980    

Description Rohit Keshri 2023-12-18 10:27:34 UTC 
A Null pointer de-reference problem was found in ida_free in lib/idr.c file when it calls the xas_load function and returns a null value, assigning NULL to the bitmap variable.

Therefore, `if (xa_is_value(bitmap))` will fail and jump to the `else` branch. However, in the else branch, the statement `if (!test_bit(bit, bitmap->bitmap))` references the member of bitmap, which triggers a null pointer dereference vulnerability.

Reference:
https://github.com/torvalds/linux/commit/af73483f4e8b6f5c68c9aa63257bdd929a9c194a
Comment 7 Marian Rehak 2024-01-15 09:05:50 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2258419]
Comment 13 errata-xmlrpc 2024-04-30 10:14:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2394 https://access.redhat.com/errata/RHSA-2024:2394
Comment 14 errata-xmlrpc 2024-05-22 09:15:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:2950 https://access.redhat.com/errata/RHSA-2024:2950
Comment 15 errata-xmlrpc 2024-05-22 09:52:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:3138 https://access.redhat.com/errata/RHSA-2024:3138