efi: fix NULL-deref in init error path (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.24 % · percentile 15 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: efi: fix NULL-deref in init error path In cases where runtime services are not supported or have been disabled, the runtime services workqueue will never have been allocated. Do not try to destroy the workqueue unconditionally in the unlikely event that EFI initialisation fails to avoid dereferencing a NULL pointer.
Weaknesses (CWE)
- CWE-476 — NULL Pointer Dereference
References
- https://git.kernel.org/stable/c/585a0b2b3ae7903c6abee3087d09c69e955a7794
- https://git.kernel.org/stable/c/5fcf75a8a4c3e7ee9122d143684083c9faf20452
- https://git.kernel.org/stable/c/4ca71bc0e1995d15486cd7b60845602a28399cb5
- https://git.kernel.org/stable/c/e2ea55564229e4bea1474af15b111b3a3043b76f
- https://git.kernel.org/stable/c/adc96d30f6503d30dc68670c013716f1d9fcc747
- https://git.kernel.org/stable/c/703c13fe3c9af557d312f5895ed6a5fda2711104
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2022-53758
- GCVE · GCVE-0-2022-48879
CERT-FR advisories
- CERTFR-2025-AVI-1057 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1102 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1048 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1033 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0999 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.19.142 < 4.19.270cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.61 < 5.4.229cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.9 < 5.10.164cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.89cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.7
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 2ff3c97b47521d6700cc6485c7935908dcd2c27c < 585a0b2b3ae7903c6abee3087d09c69e955a7794 ; affected 5167f194da6947e19a3e970485ee3ccb44f7958d < 5fcf75a8a4c3e7ee9122d143684083c9faf20452 ; affected 98086df8b70c06234a8f4290c46064e44dafa0ed < 4ca71bc0e1995d15486cd7b60845602a28399cb5 ; affected 98086df8b70c06234a8f4290c46064e44dafa0ed < e2ea55564229e4bea1474af15b111b3a3043b76f ; affected 98086df8b70c06234a8f4290c46064e44dafa0ed < adc96d30f6503d30dc68670c013716f1d9fcc747 ; affected 98086df8b70c06234a8f4290c46064e44dafa0ed < 703c13fe3c9af557d312f5895ed6a5fda2711104 |
| Linux · Linux | affected 5.9 ; unaffected 0 < 5.9 ; unaffected 4.19.270 ≤ 4.19.* ; unaffected 5.4.229 ≤ 5.4.* ; unaffected 5.10.164 ≤ 5.10.* ; unaffected 5.15.89 ≤ 5.15.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |