CVE-2023-29941 Null dereference in n/a

Medium 5.5 Published 5 May 2023 Updated 29 Jan 2025

A segmentation fault in the LLVM sparse tensor sort operation allows attackers to cause a denial of service via crafted input.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-29941?

CVE-2023-29941 is a medium-severity vulnerability in n/a, published on 5 May 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

llvm-project commit a0138390 was discovered to contain a segmentation fault via the component matchAndRewriteSortOp<mlir::sparse_tensor::SortOp>(mlir::sparse_tensor::SortOp.

Weakness: CWE-125

Which versions are affected by CVE-2023-29941?

It affects 1 product.

Products include Llvm Llvm.

How do I fix CVE-2023-29941?

Apply the vendor's patch.

Is CVE-2023-29941 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-29941 exists.

Sources

Also known as AZL-26404, AZL-26408, AZL-38767, DEBIAN-CVE-2023-29941, GHSA-g8w2-r832-c3p7.