CVE-2023-52445

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52445
In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix use after free on context disconnection Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2cf0005d315549b8d2b940ff96a66c2a889aa795 Patch
https://git.kernel.org/stable/c/30773ea47d41773f9611ffb4ebc9bda9d19a9e7e Patch
https://git.kernel.org/stable/c/3233d8bf7893550045682192cb227af7fa3defeb Patch
https://git.kernel.org/stable/c/437b5f57732bb4cc32cc9f8895d2010ee9ff521c Patch
https://git.kernel.org/stable/c/47aa8fcd5e8b5563af4042a00f25ba89bef8f33d Patch
https://git.kernel.org/stable/c/ded85b0c0edd8f45fec88783d7555a5b982449c1 Patch
https://git.kernel.org/stable/c/ec3634ebe23fc3c44ebc67c6d25917300bc68c08 Patch
https://git.kernel.org/stable/c/ec36c134dd020d28e312c2f1766f85525e747aab Patch
https://git.kernel.org/stable/c/2cf0005d315549b8d2b940ff96a66c2a889aa795 Patch
https://git.kernel.org/stable/c/30773ea47d41773f9611ffb4ebc9bda9d19a9e7e Patch
https://git.kernel.org/stable/c/3233d8bf7893550045682192cb227af7fa3defeb Patch
https://git.kernel.org/stable/c/437b5f57732bb4cc32cc9f8895d2010ee9ff521c Patch
https://git.kernel.org/stable/c/47aa8fcd5e8b5563af4042a00f25ba89bef8f33d Patch
https://git.kernel.org/stable/c/ded85b0c0edd8f45fec88783d7555a5b982449c1 Patch
https://git.kernel.org/stable/c/ec3634ebe23fc3c44ebc67c6d25917300bc68c08 Patch
https://git.kernel.org/stable/c/ec36c134dd020d28e312c2f1766f85525e747aab Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 Nov 2024, 08:39

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html -
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
References () https://git.kernel.org/stable/c/2cf0005d315549b8d2b940ff96a66c2a889aa795 - Patch () https://git.kernel.org/stable/c/2cf0005d315549b8d2b940ff96a66c2a889aa795 - Patch
References () https://git.kernel.org/stable/c/30773ea47d41773f9611ffb4ebc9bda9d19a9e7e - Patch () https://git.kernel.org/stable/c/30773ea47d41773f9611ffb4ebc9bda9d19a9e7e - Patch
References () https://git.kernel.org/stable/c/3233d8bf7893550045682192cb227af7fa3defeb - Patch () https://git.kernel.org/stable/c/3233d8bf7893550045682192cb227af7fa3defeb - Patch
References () https://git.kernel.org/stable/c/437b5f57732bb4cc32cc9f8895d2010ee9ff521c - Patch () https://git.kernel.org/stable/c/437b5f57732bb4cc32cc9f8895d2010ee9ff521c - Patch
References () https://git.kernel.org/stable/c/47aa8fcd5e8b5563af4042a00f25ba89bef8f33d - Patch () https://git.kernel.org/stable/c/47aa8fcd5e8b5563af4042a00f25ba89bef8f33d - Patch
References () https://git.kernel.org/stable/c/ded85b0c0edd8f45fec88783d7555a5b982449c1 - Patch () https://git.kernel.org/stable/c/ded85b0c0edd8f45fec88783d7555a5b982449c1 - Patch
References () https://git.kernel.org/stable/c/ec3634ebe23fc3c44ebc67c6d25917300bc68c08 - Patch () https://git.kernel.org/stable/c/ec3634ebe23fc3c44ebc67c6d25917300bc68c08 - Patch
References () https://git.kernel.org/stable/c/ec36c134dd020d28e312c2f1766f85525e747aab - Patch () https://git.kernel.org/stable/c/ec36c134dd020d28e312c2f1766f85525e747aab - Patch

04 Nov 2024, 13:16

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

27 Jun 2024, 12:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -

25 Jun 2024, 21:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html -

14 Mar 2024, 20:13

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: medios: pvrusb2: corrige el use after free de desconexión de contexto. Al cargar el módulo, se crea un kthread dirigido a la función pvr2_context_thread_func, que puede llamar a pvr2_context_destroy y, por lo tanto, llamar a kfree() en el objeto de contexto. Sin embargo, eso podría suceder antes de que el controlador usb hub_event pueda notificar al controlador. Este parche agrega una verificación de cordura antes de la lectura no válida reportada por syzbot, dentro de la pila de llamadas de desconexión de contexto.
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/2cf0005d315549b8d2b940ff96a66c2a889aa795 - () https://git.kernel.org/stable/c/2cf0005d315549b8d2b940ff96a66c2a889aa795 - Patch
References () https://git.kernel.org/stable/c/30773ea47d41773f9611ffb4ebc9bda9d19a9e7e - () https://git.kernel.org/stable/c/30773ea47d41773f9611ffb4ebc9bda9d19a9e7e - Patch
References () https://git.kernel.org/stable/c/3233d8bf7893550045682192cb227af7fa3defeb - () https://git.kernel.org/stable/c/3233d8bf7893550045682192cb227af7fa3defeb - Patch
References () https://git.kernel.org/stable/c/437b5f57732bb4cc32cc9f8895d2010ee9ff521c - () https://git.kernel.org/stable/c/437b5f57732bb4cc32cc9f8895d2010ee9ff521c - Patch
References () https://git.kernel.org/stable/c/47aa8fcd5e8b5563af4042a00f25ba89bef8f33d - () https://git.kernel.org/stable/c/47aa8fcd5e8b5563af4042a00f25ba89bef8f33d - Patch
References () https://git.kernel.org/stable/c/ded85b0c0edd8f45fec88783d7555a5b982449c1 - () https://git.kernel.org/stable/c/ded85b0c0edd8f45fec88783d7555a5b982449c1 - Patch
References () https://git.kernel.org/stable/c/ec3634ebe23fc3c44ebc67c6d25917300bc68c08 - () https://git.kernel.org/stable/c/ec3634ebe23fc3c44ebc67c6d25917300bc68c08 - Patch
References () https://git.kernel.org/stable/c/ec36c134dd020d28e312c2f1766f85525e747aab - () https://git.kernel.org/stable/c/ec36c134dd020d28e312c2f1766f85525e747aab - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-416

22 Feb 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-22 17:15

Updated : 2024-11-21 08:39

NVD link : CVE-2023-52445

Mitre link : CVE-2023-52445

CVE.ORG link : CVE-2023-52445

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free