CVE-2023-22997: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-22997 is a vulnerability discovered in the Linux kernel before version 6.1.2, affecting the module decompression implementation. The issue lies in kernel/module/decompress.c where it incorrectly interprets the modulegetnext_page return value, expecting it to be NULL in error cases when it actually returns an error pointer (CVE, Ubuntu).

The vulnerability stems from a mishandling of return values in the kernel's module decompression code. The modulegetnextpage() function returns error pointers on error instead of NULL, but the code was incorrectly checking for NULL instead of using ISERR() to check the return value. This issue affects the implementation in kernel/module/decompress.c (GitHub Commit). The vulnerability has been assigned a CVSS v3 severity score of 5.5 (Medium) (Ubuntu).

When exploited, this vulnerability could allow a local attacker to cause a denial of service condition through a system crash (Ubuntu).

The vulnerability has been fixed in Linux kernel version 6.1.2. The fix involves properly checking the return value using IS_ERR() instead of checking for NULL. Users are advised to upgrade their Linux kernel to version 6.1.2 or later (CVE, GitHub Commit).