CVE-2023-22997

What it actually does

The kernel module decompression code in decompress.c treats an ERR_PTR return value from module_get_next_page as a valid page pointer instead of detecting the error condition, leading to invalid memory access and potential kernel crash.

Why it matters to the business

Local users or compromised processes can trigger denial of service on affected Linux systems by loading specially crafted kernel modules, causing unplanned reboots or service outages with no data exposure.

How an attack unfolds

An attacker with local access crafts or supplies a compressed kernel module that triggers the error path in module_get_next_page, causing the misinterpretation of the error pointer and subsequent invalid dereference during decompression.

How to fix it

Update the Linux kernel to a version containing commit 45af1d7aae7d5520d2858f8517a1342646f015db or later (equivalent to 6.1.2 or newer stable releases) and reboot.

How to confirm the fix worked

Confirm the running kernel version is 6.1.2 or newer and that the commit 45af1d7aae7d5520d2858f8517a1342646f015db is present in the source tree; attempt to load a module that exercises the decompression error path and verify no crash occurs.

Typical attack path

1. Obtain local user or process execution on the target system
2. Prepare a compressed kernel module that forces module_get_next_page to return an error pointer
3. Invoke module loading via insmod or similar interface
4. Trigger the misinterpretation in decompress.c resulting in kernel panic

How to detect it

Review kernel logs for oops or panic messages referencing module decompression or module_get_next_page; look for unexpected module load attempts followed by system instability.

What your security team should do

• Prioritize kernel upgrades on all systems that accept local module loading
• Restrict unprivileged module loading via kernel configuration options such as modules_disabled
• Monitor for kernel oops or panic events related to module decompression