CVE-2023-6679

What it actually does

Null pointer dereference in dpll_pin_parent_pin_set() within the DPLL netlink handler that crashes the kernel when processing specific requests.

Why it matters to the business

Local users can trigger system crashes leading to unplanned downtime and disruption of services running on affected Linux systems.

How an attack unfolds

An attacker with local access on a vulnerable kernel sends a crafted netlink message targeting the DPLL subsystem to dereference a null pointer and induce a kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the null pointer dereference in drivers/dpll/dpll_netlink.c; apply vendor-supplied updates for distributions such as Fedora and Red Hat Enterprise Linux.

How to confirm the fix worked

Verify the installed kernel version includes the upstream fix; review dpll_netlink.c source for the added null check before dpll_pin_parent_pin_set() dereference.

Typical attack path

1. Gain local user access on the target system
2. Construct and transmit a malicious DPLL netlink request
3. Trigger kernel panic resulting in denial of service

How to detect it

Inspect kernel logs and dmesg output for null pointer dereference traces originating from dpll_netlink.c or the DPLL subsystem.

What your security team should do

• Prioritize kernel updates on all affected systems
• Limit local user privileges where feasible to reduce attack surface
• Monitor kernel logs for DPLL-related oops or panic events