CVE-2023-6679: 
Linux Kernel vulnerability analysis and mitigation

A null pointer dereference vulnerability (CVE-2023-6679) was discovered in the dpll_pin_parent_pin_set() function in drivers/dpll/dpll_netlink.c in the Digital Phase Locked Loop (DPLL) subsystem of the Linux kernel. The vulnerability was reported on December 11, 2023 (NVD, Red Hat).

The vulnerability occurs when a user does not pass the DPLL_A_PIN_STATE attribute in the pin set operation message, leading to a null pointer dereference. The issue was identified in the Linux kernel's DPLL subsystem and has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Red Hat).

This vulnerability could be exploited to trigger a denial of service condition in affected systems (NVD).

The vulnerability requires local access with low privileges to exploit. No known active exploits have been reported in the wild (Red Hat).

A fix has been implemented that sanitizes the null pointer by checking if the attr pointer is not null and only processing the passed state attribute value in that case. The fix has been included in various Linux distributions through security updates, including Red Hat Enterprise Linux via RHSA-2024:0439, RHSA-2024:0448, and RHSA-2024:0461 (Kernel Patch).