CVE-2023-52520

platform/x86: think-lmi: Fix reference leak

Description

In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix reference leak If a duplicate attribute is found using kset_find_obj(), a reference to that attribute is returned which needs to be disposed accordingly using kobject_put(). Move the setting name validation into a separate function to allow for this change without having to duplicate the cleanup code for this setting. As a side note, a very similar bug was fixed in commit 7295a996fdab ("platform/x86: dell-sysman: Fix reference leak"), so it seems that the bug was copied from that driver. Compile-tested only.

5.5

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 0.01%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/124cf0ea4b82e1444ec8c7420af4e7db5558c293	patch
https://git.kernel.org/stable/c/af21c9119a37cecb7ff27ce0c2f3cf721e9d0ec4	patch
https://git.kernel.org/stable/c/c6e3023579de8d33256771ac0745239029e81106	patch
https://git.kernel.org/stable/c/528ab3e605cabf2f9c9bd5944d3bfe15f6e94f81	patch

Frequently Asked Questions

What is the severity of CVE-2023-52520?: CVE-2023-52520 has been scored as a medium severity vulnerability.
How to fix CVE-2023-52520?: To fix CVE-2023-52520, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-52520 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2023-52520 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-52520?: CVE-2023-52520 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.