CVE-2023-52864

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52864
In the Linux kernel, the following vulnerability has been resolved: platform/x86: wmi: Fix opening of char device Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp->private_data, which means that private_data will not be NULL when wmi_char_open() is called. This might cause memory corruption should wmi_char_open() be unable to find its driver, something which can happen when the associated WMI device is deleted in wmi_free_devices(). Fix the problem by using the miscdevice pointer to retrieve the WMI device data associated with a char device using container_of(). This also avoids wmi_char_open() picking a wrong WMI device bound to a driver with the same name as the original driver.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/36d85fa7ae0d6be651c1a745191fa7ef055db43e Patch
https://git.kernel.org/stable/c/44a96796d25809502c75771d40ee693c2e44724e Patch
https://git.kernel.org/stable/c/9fb0eed09e1470cd4021ff52b2b9dfcbcee4c203 Patch
https://git.kernel.org/stable/c/cf098e937dd125c0317a0d6f261ac2a950a233d6 Patch
https://git.kernel.org/stable/c/d426a2955e45a95b2282764105fcfb110a540453 Patch
https://git.kernel.org/stable/c/e0bf076b734a2fab92d8fddc2b8b03462eee7097 Patch
https://git.kernel.org/stable/c/eba9ac7abab91c8f6d351460239108bef5e7a0b6 Patch
https://git.kernel.org/stable/c/fb7b06b59c6887659c6ed0ecd3110835eecbb6a3 Patch
https://git.kernel.org/stable/c/36d85fa7ae0d6be651c1a745191fa7ef055db43e Patch
https://git.kernel.org/stable/c/44a96796d25809502c75771d40ee693c2e44724e Patch
https://git.kernel.org/stable/c/9fb0eed09e1470cd4021ff52b2b9dfcbcee4c203 Patch
https://git.kernel.org/stable/c/cf098e937dd125c0317a0d6f261ac2a950a233d6 Patch
https://git.kernel.org/stable/c/d426a2955e45a95b2282764105fcfb110a540453 Patch
https://git.kernel.org/stable/c/e0bf076b734a2fab92d8fddc2b8b03462eee7097 Patch
https://git.kernel.org/stable/c/eba9ac7abab91c8f6d351460239108bef5e7a0b6 Patch
https://git.kernel.org/stable/c/fb7b06b59c6887659c6ed0ecd3110835eecbb6a3 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

24 Sep 2025, 00:15

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/36d85fa7ae0d6be651c1a745191fa7ef055db43e - () https://git.kernel.org/stable/c/36d85fa7ae0d6be651c1a745191fa7ef055db43e - Patch
References () https://git.kernel.org/stable/c/44a96796d25809502c75771d40ee693c2e44724e - () https://git.kernel.org/stable/c/44a96796d25809502c75771d40ee693c2e44724e - Patch
References () https://git.kernel.org/stable/c/9fb0eed09e1470cd4021ff52b2b9dfcbcee4c203 - () https://git.kernel.org/stable/c/9fb0eed09e1470cd4021ff52b2b9dfcbcee4c203 - Patch
References () https://git.kernel.org/stable/c/cf098e937dd125c0317a0d6f261ac2a950a233d6 - () https://git.kernel.org/stable/c/cf098e937dd125c0317a0d6f261ac2a950a233d6 - Patch
References () https://git.kernel.org/stable/c/d426a2955e45a95b2282764105fcfb110a540453 - () https://git.kernel.org/stable/c/d426a2955e45a95b2282764105fcfb110a540453 - Patch
References () https://git.kernel.org/stable/c/e0bf076b734a2fab92d8fddc2b8b03462eee7097 - () https://git.kernel.org/stable/c/e0bf076b734a2fab92d8fddc2b8b03462eee7097 - Patch
References () https://git.kernel.org/stable/c/eba9ac7abab91c8f6d351460239108bef5e7a0b6 - () https://git.kernel.org/stable/c/eba9ac7abab91c8f6d351460239108bef5e7a0b6 - Patch
References () https://git.kernel.org/stable/c/fb7b06b59c6887659c6ed0ecd3110835eecbb6a3 - () https://git.kernel.org/stable/c/fb7b06b59c6887659c6ed0ecd3110835eecbb6a3 - Patch
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-787
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

21 Nov 2024, 08:40

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/36d85fa7ae0d6be651c1a745191fa7ef055db43e - () https://git.kernel.org/stable/c/36d85fa7ae0d6be651c1a745191fa7ef055db43e -
References () https://git.kernel.org/stable/c/44a96796d25809502c75771d40ee693c2e44724e - () https://git.kernel.org/stable/c/44a96796d25809502c75771d40ee693c2e44724e -
References () https://git.kernel.org/stable/c/9fb0eed09e1470cd4021ff52b2b9dfcbcee4c203 - () https://git.kernel.org/stable/c/9fb0eed09e1470cd4021ff52b2b9dfcbcee4c203 -
References () https://git.kernel.org/stable/c/cf098e937dd125c0317a0d6f261ac2a950a233d6 - () https://git.kernel.org/stable/c/cf098e937dd125c0317a0d6f261ac2a950a233d6 -
References () https://git.kernel.org/stable/c/d426a2955e45a95b2282764105fcfb110a540453 - () https://git.kernel.org/stable/c/d426a2955e45a95b2282764105fcfb110a540453 -
References () https://git.kernel.org/stable/c/e0bf076b734a2fab92d8fddc2b8b03462eee7097 - () https://git.kernel.org/stable/c/e0bf076b734a2fab92d8fddc2b8b03462eee7097 -
References () https://git.kernel.org/stable/c/eba9ac7abab91c8f6d351460239108bef5e7a0b6 - () https://git.kernel.org/stable/c/eba9ac7abab91c8f6d351460239108bef5e7a0b6 -
References () https://git.kernel.org/stable/c/fb7b06b59c6887659c6ed0ecd3110835eecbb6a3 - () https://git.kernel.org/stable/c/fb7b06b59c6887659c6ed0ecd3110835eecbb6a3 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: plataforma/x86: wmi: corrige la apertura del dispositivo char. Desde la confirmación fa1f68db6ca7 ("drivers: misc: pasar el puntero del dispositivo misc a través de datos privados del archivo"), el dispositivo misc almacena un puntero a sí mismo en su interior. filp->private_data, lo que significa que private_data no será NULL cuando se llame a wmi_char_open(). Esto podría causar daños en la memoria si wmi_char_open() no puede encontrar su controlador, algo que puede suceder cuando el dispositivo WMI asociado se elimina en wmi_free_devices(). Solucione el problema utilizando el puntero miscdevice para recuperar los datos del dispositivo WMI asociados con un dispositivo char usando container_of(). Esto también evita que wmi_char_open() seleccione un dispositivo WMI incorrecto vinculado a un controlador con el mismo nombre que el controlador original.

21 May 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-21 16:15

Updated : 2025-09-24 00:15

NVD link : CVE-2023-52864

Mitre link : CVE-2023-52864

CVE.ORG link : CVE-2023-52864

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-787

Out-of-bounds Write