Medium severity · published Jun 23, 2023
CVE-2023-3212
A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel
4.4
CVSS
0.3%
EPSS
No
On KEV
Description
A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
before 6.4; 6.4 · source: NVD
LK
Linux kernel (gfs2 file system) ·
Fixed in kernel 6.4-rc2 · source: vendor
DL
Debian Linux · Debian
10.0; 11.0; 12.0 · source: NVD
EL
Enterprise Linux · Redhat
8.0; 9.0 · source: NVD
FE
Fedora · Fedoraproject
38 · source: NVD
HF
H300s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H410c Firmware · Netapp
All versions, or not specified · source: NVD
HF
H410s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H500s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H700s Firmware · Netapp
All versions, or not specified · source: NVD
SS
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SS
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3212
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3212
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2214348
Patch
https://github.com/torvalds/linux/commit/504a10d9e46bc37b23d0a1ae2f28973c8516e636
Mailing List
https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230929-0005/
Third Party Advisory
https://www.debian.org/security/2023/dsa-5448
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability