CVE-2023-52893

gsmi: fix null-deref in gsmi_get_variable

State: Published
Severity: Not scored
Published: Aug 21, 2024
Updated: May 11, 2026
Reserved: Aug 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

gsmi: fix null-deref in gsmi_get_variable

We can get EFI variables without fetching the attribute, so we must allow for that in gsmi.

commit 859748255b43 ("efi: pstore: Omit efivars caching EFI varstore access layer") added a new get_variable call with attr=NULL, which triggers panic in gsmi.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	74c5b31c6618f01079212332b2e5f6c42f2d6307 to before ee5763ef829bd923033510de6d1df7c73f085e4bAffected 74c5b31c6618f01079212332b2e5f6c42f2d6307 to before 32313c11bdc8a02c577abaf865be3664ab30410aAffected 74c5b31c6618f01079212332b2e5f6c42f2d6307 to before ffef77794fb5f1245c3249b86342bad2299accb5Affected 74c5b31c6618f01079212332b2e5f6c42f2d6307 to before ae2a9dcc8caa60b1e14671294e5ec902ea5d1dfdAffected 74c5b31c6618f01079212332b2e5f6c42f2d6307 to before eb0421d90f916dffe96b4c049ddf01c0c50620d2Affected 74c5b31c6618f01079212332b2e5f6c42f2d6307 to before 6646d769fdb0ce4318ef9afd127f8526d1ca8393Affected 74c5b31c6618f01079212332b2e5f6c42f2d6307 to before a769b05eeed7accc4019a1ed9799dd72067f1ce8Affected
LinuxLinux	3.0Affected before 3.0Not affected 4.14.304 through 4.14.Not affected 4.19.271 through 4.19.Not affected 5.4.230 through 5.4.Not affected 5.10.165 through 5.10.Not affected 5.15.90 through 5.15.Not affected 6.1.8 through 6.1.Not affected 6.2 and laterNot affected

Product

Versions

LinuxLinux

74c5b31c6618f01079212332b2e5f6c42f2d6307 to before ee5763ef829bd923033510de6d1df7c73f085e4bAffected
74c5b31c6618f01079212332b2e5f6c42f2d6307 to before 32313c11bdc8a02c577abaf865be3664ab30410aAffected
74c5b31c6618f01079212332b2e5f6c42f2d6307 to before ffef77794fb5f1245c3249b86342bad2299accb5Affected
74c5b31c6618f01079212332b2e5f6c42f2d6307 to before ae2a9dcc8caa60b1e14671294e5ec902ea5d1dfdAffected
74c5b31c6618f01079212332b2e5f6c42f2d6307 to before eb0421d90f916dffe96b4c049ddf01c0c50620d2Affected
74c5b31c6618f01079212332b2e5f6c42f2d6307 to before 6646d769fdb0ce4318ef9afd127f8526d1ca8393Affected
74c5b31c6618f01079212332b2e5f6c42f2d6307 to before a769b05eeed7accc4019a1ed9799dd72067f1ce8Affected

LinuxLinux

3.0Affected
before 3.0Not affected
4.14.304 through 4.14.*Not affected
4.19.271 through 4.19.*Not affected
5.4.230 through 5.4.*Not affected
5.10.165 through 5.10.*Not affected
5.15.90 through 5.15.*Not affected
6.1.8 through 6.1.*Not affected
6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.