CVE-2023-52493

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52493
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Drop chan lock before queuing buffers Ensure read and write locks for the channel are not taken in succession by dropping the read lock from parse_xfer_event() such that a callback given to client can potentially queue buffers and acquire the write lock in that process. Any queueing of buffers should be done without channel read lock acquired as it can result in multiple locks and a soft lockup. [mani: added fixes tag and cc'ed stable]

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/01bd694ac2f682fb8017e16148b928482bc8fa4b Patch
https://git.kernel.org/stable/c/20a6dea2d1c68d4e03c6bb50bc12e72e226b5c0e Patch
https://git.kernel.org/stable/c/3c5ec66b4b3f6816f3a6161538672e389e537690 Patch
https://git.kernel.org/stable/c/6e4c84316e2b70709f0d00c33ba3358d9fc8eece Patch
https://git.kernel.org/stable/c/b8eff20d87092e14cac976d057cb0aea2f1d0830 Patch
https://git.kernel.org/stable/c/eaefb9464031215d63c0a8a7e2bfaa00736aa17e Patch
https://git.kernel.org/stable/c/01bd694ac2f682fb8017e16148b928482bc8fa4b Patch
https://git.kernel.org/stable/c/20a6dea2d1c68d4e03c6bb50bc12e72e226b5c0e Patch
https://git.kernel.org/stable/c/3c5ec66b4b3f6816f3a6161538672e389e537690 Patch
https://git.kernel.org/stable/c/6e4c84316e2b70709f0d00c33ba3358d9fc8eece Patch
https://git.kernel.org/stable/c/b8eff20d87092e14cac976d057cb0aea2f1d0830 Patch
https://git.kernel.org/stable/c/eaefb9464031215d63c0a8a7e2bfaa00736aa17e Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

12 Dec 2024, 15:57

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-667
References () https://git.kernel.org/stable/c/01bd694ac2f682fb8017e16148b928482bc8fa4b - () https://git.kernel.org/stable/c/01bd694ac2f682fb8017e16148b928482bc8fa4b - Patch
References () https://git.kernel.org/stable/c/20a6dea2d1c68d4e03c6bb50bc12e72e226b5c0e - () https://git.kernel.org/stable/c/20a6dea2d1c68d4e03c6bb50bc12e72e226b5c0e - Patch
References () https://git.kernel.org/stable/c/3c5ec66b4b3f6816f3a6161538672e389e537690 - () https://git.kernel.org/stable/c/3c5ec66b4b3f6816f3a6161538672e389e537690 - Patch
References () https://git.kernel.org/stable/c/6e4c84316e2b70709f0d00c33ba3358d9fc8eece - () https://git.kernel.org/stable/c/6e4c84316e2b70709f0d00c33ba3358d9fc8eece - Patch
References () https://git.kernel.org/stable/c/b8eff20d87092e14cac976d057cb0aea2f1d0830 - () https://git.kernel.org/stable/c/b8eff20d87092e14cac976d057cb0aea2f1d0830 - Patch
References () https://git.kernel.org/stable/c/eaefb9464031215d63c0a8a7e2bfaa00736aa17e - () https://git.kernel.org/stable/c/eaefb9464031215d63c0a8a7e2bfaa00736aa17e - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - Patch
First Time Linux linux Kernel
Linux

21 Nov 2024, 08:39

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
References () https://git.kernel.org/stable/c/01bd694ac2f682fb8017e16148b928482bc8fa4b - () https://git.kernel.org/stable/c/01bd694ac2f682fb8017e16148b928482bc8fa4b -
References () https://git.kernel.org/stable/c/20a6dea2d1c68d4e03c6bb50bc12e72e226b5c0e - () https://git.kernel.org/stable/c/20a6dea2d1c68d4e03c6bb50bc12e72e226b5c0e -
References () https://git.kernel.org/stable/c/3c5ec66b4b3f6816f3a6161538672e389e537690 - () https://git.kernel.org/stable/c/3c5ec66b4b3f6816f3a6161538672e389e537690 -
References () https://git.kernel.org/stable/c/6e4c84316e2b70709f0d00c33ba3358d9fc8eece - () https://git.kernel.org/stable/c/6e4c84316e2b70709f0d00c33ba3358d9fc8eece -
References () https://git.kernel.org/stable/c/b8eff20d87092e14cac976d057cb0aea2f1d0830 - () https://git.kernel.org/stable/c/b8eff20d87092e14cac976d057cb0aea2f1d0830 -
References () https://git.kernel.org/stable/c/eaefb9464031215d63c0a8a7e2bfaa00736aa17e - () https://git.kernel.org/stable/c/eaefb9464031215d63c0a8a7e2bfaa00736aa17e -

04 Nov 2024, 13:16

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

25 Jun 2024, 22:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bus: mhi: host: Eliminar el bloqueo de canal antes de poner en cola los búferes asegúrese de que los bloqueos de lectura y escritura para el canal no se tomen en sucesión eliminando el bloqueo de lectura de parse_xfer_event() de manera que se pueda realizar una devolución de llamada dado al cliente puede potencialmente poner en cola los búferes y adquirir el bloqueo de escritura en ese proceso. Cualquier puesta en cola de búferes debe realizarse sin adquirir el bloqueo de lectura del canal, ya que puede generar múltiples bloqueos y un bloqueo suave. [mani: etiqueta de correcciones agregada y copia estable]
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -

11 Mar 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-11 18:15

Updated : 2024-12-12 15:57

NVD link : CVE-2023-52493

Mitre link : CVE-2023-52493

CVE.ORG link : CVE-2023-52493

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-667

Improper Locking