CVE-2023-52893

What it actually does

Null pointer dereference in gsmi_get_variable when the attribute pointer is passed as NULL, resulting in a kernel panic during EFI variable retrieval without attributes.

Why it matters to the business

Unexpected system crashes on affected Linux kernels disrupt operations and availability; widespread use in servers and devices amplifies downtime risk, though no active exploitation or ransomware use is observed.

How an attack unfolds

An attacker triggers the vulnerable code path by invoking EFI variable access that omits attribute fetching, such as through pstore or efivars mechanisms introduced in related changes, causing the null dereference and crash.

How to fix it

Update the Linux kernel to a version containing commit ee5763ef829bd923033510de6d1df7c73f085e4b or later; apply the fix that allows NULL attributes in gsmi_get_variable.

How to confirm the fix worked

Confirm the kernel source includes the referenced commit; test EFI variable access paths to ensure no panic occurs when attributes are omitted.

Typical attack path

1. Identify a system running an affected Linux kernel with gsmi enabled
2. Trigger EFI variable get operations that pass NULL for attributes
3. Cause kernel panic via the dereference in gsmi_get_variable

How to detect it

Inspect kernel logs for oops or panic messages referencing gsmi_get_variable or null dereferences during EFI variable operations; review system call traces involving efivars or pstore.

What your security team should do

• Prioritize kernel updates on all affected systems within standard patching cycles
• Monitor for kernel oops or panic logs related to gsmi
• Review EFI and pstore configurations to limit unnecessary variable access