CVE-2023-54279

Vulnerability

Vulnerability

CVE-2023-54279 is a null pointer dereference vulnerability in the Linux kernel's MIPS architecture firmware interface. The fw_getenv function uses an environment entry to determine the style of the environment, but it does not account for the case where the firmware passes an empty list. This leads to a null pointer dereference when strchr is called on a non-existent first entry [1][2][3].

Exploitation

An attacker with the ability to control or influence the firmware environment passed to the kernel could trigger this bug. The attack surface is limited to systems using MIPS firmware that can supply an empty environment list. No authentication is required, but the attacker must be able to modify the firmware environment or boot parameters [1][2][3].

Impact

Successful exploitation results in a kernel crash (denial of service) due to the null pointer dereference. This could cause system instability or a complete system hang. There is no indication of privilege escalation or data corruption from this vulnerability [1][2][3].

Mitigation

The fix is included in Linux kernel stable updates. Users should apply the latest kernel updates from their distribution. The commit identifiers are a6b54af40787, 0f91290774c7, and 47e61cadc7a5 [1][2][3].