CVE-2023-52498

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52498
In the Linux kernel, the following vulnerability has been resolved: PM: sleep: Fix possible deadlocks in core system-wide PM code It is reported that in low-memory situations the system-wide resume core code deadlocks, because async_schedule_dev() executes its argument function synchronously if it cannot allocate memory (and not only in that case) and that function attempts to acquire a mutex that is already held. Executing the argument function synchronously from within dpm_async_fn() may also be problematic for ordering reasons (it may cause a consumer device's resume callback to be invoked before a requisite supplier device's one, for example). Address this by changing the code in question to use async_schedule_dev_nocall() for scheduling the asynchronous execution of device suspend and resume functions and to directly run them synchronously if async_schedule_dev_nocall() returns false.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/7839d0078e0d5e6cc2fa0b0dfbee71de74f1e557 Patch
https://git.kernel.org/stable/c/9bd3dce27b01c51295b60e1433e1dadfb16649f7 Patch
https://git.kernel.org/stable/c/a1d62c775b07213c73f81ae842424c74dd14b5f0 Patch
https://git.kernel.org/stable/c/e1c9d32c98309ae764893a481552d3f99d46cb34 Patch
https://git.kernel.org/stable/c/e681e29d1f59a04ef773296e4bebb17b1b79f8fe Patch
https://git.kernel.org/stable/c/f46eb832389f162ad13cb780d0b8cde93641990d Patch
https://git.kernel.org/stable/c/7839d0078e0d5e6cc2fa0b0dfbee71de74f1e557 Patch
https://git.kernel.org/stable/c/9bd3dce27b01c51295b60e1433e1dadfb16649f7 Patch
https://git.kernel.org/stable/c/a1d62c775b07213c73f81ae842424c74dd14b5f0 Patch
https://git.kernel.org/stable/c/e1c9d32c98309ae764893a481552d3f99d46cb34 Patch
https://git.kernel.org/stable/c/e681e29d1f59a04ef773296e4bebb17b1b79f8fe Patch
https://git.kernel.org/stable/c/f46eb832389f162ad13cb780d0b8cde93641990d Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

12 Dec 2024, 17:32

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-667
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/7839d0078e0d5e6cc2fa0b0dfbee71de74f1e557 - () https://git.kernel.org/stable/c/7839d0078e0d5e6cc2fa0b0dfbee71de74f1e557 - Patch
References () https://git.kernel.org/stable/c/9bd3dce27b01c51295b60e1433e1dadfb16649f7 - () https://git.kernel.org/stable/c/9bd3dce27b01c51295b60e1433e1dadfb16649f7 - Patch
References () https://git.kernel.org/stable/c/a1d62c775b07213c73f81ae842424c74dd14b5f0 - () https://git.kernel.org/stable/c/a1d62c775b07213c73f81ae842424c74dd14b5f0 - Patch
References () https://git.kernel.org/stable/c/e1c9d32c98309ae764893a481552d3f99d46cb34 - () https://git.kernel.org/stable/c/e1c9d32c98309ae764893a481552d3f99d46cb34 - Patch
References () https://git.kernel.org/stable/c/e681e29d1f59a04ef773296e4bebb17b1b79f8fe - () https://git.kernel.org/stable/c/e681e29d1f59a04ef773296e4bebb17b1b79f8fe - Patch
References () https://git.kernel.org/stable/c/f46eb832389f162ad13cb780d0b8cde93641990d - () https://git.kernel.org/stable/c/f46eb832389f162ad13cb780d0b8cde93641990d - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - Patch

21 Nov 2024, 08:39

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
References () https://git.kernel.org/stable/c/7839d0078e0d5e6cc2fa0b0dfbee71de74f1e557 - () https://git.kernel.org/stable/c/7839d0078e0d5e6cc2fa0b0dfbee71de74f1e557 -
References () https://git.kernel.org/stable/c/9bd3dce27b01c51295b60e1433e1dadfb16649f7 - () https://git.kernel.org/stable/c/9bd3dce27b01c51295b60e1433e1dadfb16649f7 -
References () https://git.kernel.org/stable/c/a1d62c775b07213c73f81ae842424c74dd14b5f0 - () https://git.kernel.org/stable/c/a1d62c775b07213c73f81ae842424c74dd14b5f0 -
References () https://git.kernel.org/stable/c/e1c9d32c98309ae764893a481552d3f99d46cb34 - () https://git.kernel.org/stable/c/e1c9d32c98309ae764893a481552d3f99d46cb34 -
References () https://git.kernel.org/stable/c/e681e29d1f59a04ef773296e4bebb17b1b79f8fe - () https://git.kernel.org/stable/c/e681e29d1f59a04ef773296e4bebb17b1b79f8fe -
References () https://git.kernel.org/stable/c/f46eb832389f162ad13cb780d0b8cde93641990d - () https://git.kernel.org/stable/c/f46eb832389f162ad13cb780d0b8cde93641990d -

04 Nov 2024, 13:16

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

25 Jun 2024, 22:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: PM: suspensión: soluciona posibles bloqueos en el código PM de todo el sistema central. Se informa que en situaciones de poca memoria, el código central de reanudación de todo el sistema se bloquea porque async_schedule_dev() ejecuta su el argumento funciona sincrónicamente si no puede asignar memoria (y no solo en ese caso) y esa función intenta adquirir un mutex que ya está retenido. La ejecución de la función de argumento sincrónicamente desde dpm_async_fn() también puede ser problemática por razones de pedido (puede causar que la devolución de llamada de currículum de un dispositivo consumidor se invoque antes que la de un dispositivo proveedor requerido, por ejemplo). Solucione este problema cambiando el código en cuestión para usar async_schedule_dev_nocall() para programar la ejecución asincrónica de las funciones de suspensión y reanudación del dispositivo y para ejecutarlas directamente de forma sincrónica si async_schedule_dev_nocall() devuelve falso.

11 Mar 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-11 18:15

Updated : 2024-12-12 17:32

NVD link : CVE-2023-52498

Mitre link : CVE-2023-52498

CVE.ORG link : CVE-2023-52498

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-667

Improper Locking