CVE-2023-52439
Description
In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2024-3627.html
Vendor advisory: alma — https://access.redhat.com/errata/RHSA-2024:3627
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2024-3618.html
Vendor advisory: alma — https://bugzilla.redhat.com/2278537
Vendor advisory: alma — https://bugzilla.redhat.com/2278431
Vendor advisory: alma — https://bugzilla.redhat.com/2278417
Vendor advisory: alma — https://bugzilla.redhat.com/2278409
Vendor advisory: alma — https://bugzilla.redhat.com/2278398
Vendor advisory: alma — https://bugzilla.redhat.com/2278356
Vendor advisory: alma — https://bugzilla.redhat.com/2278314
Vendor advisory: alma — https://bugzilla.redhat.com/2278268
Vendor advisory: alma — https://bugzilla.redhat.com/2278240
Vendor advisory: alma — https://bugzilla.redhat.com/2278237
Vendor advisory: alma — https://bugzilla.redhat.com/2278169
Vendor advisory: alma — https://bugzilla.redhat.com/2275777
Vendor advisory: alma — https://bugzilla.redhat.com/2275707
Vendor advisory: alma — https://bugzilla.redhat.com/2275666
Vendor advisory: alma — https://bugzilla.redhat.com/2275655
Vendor advisory: alma — https://bugzilla.redhat.com/2275645
Vendor advisory: alma — https://bugzilla.redhat.com/2274624
Vendor advisory: alma — https://bugzilla.redhat.com/2273262
Vendor advisory: alma — https://bugzilla.redhat.com/2273260
Vendor advisory: alma — https://bugzilla.redhat.com/2273223
Vendor advisory: alma — https://bugzilla.redhat.com/2273094
Vendor advisory: alma — https://bugzilla.redhat.com/2273092
Vendor advisory: alma — https://bugzilla.redhat.com/2272791
Vendor advisory: alma — https://bugzilla.redhat.com/2272780
Vendor advisory: alma — https://bugzilla.redhat.com/2271476
Vendor advisory: alma — https://bugzilla.redhat.com/2271469
Vendor advisory: alma — https://bugzilla.redhat.com/2270881
Vendor advisory: alma — https://bugzilla.redhat.com/2270879
Vendor advisory: alma — https://bugzilla.redhat.com/2270080
Vendor advisory: alma — https://bugzilla.redhat.com/2269856
Vendor advisory: alma — https://bugzilla.redhat.com/2269213
Vendor advisory: alma — https://bugzilla.redhat.com/2268317
Vendor advisory: alma — https://bugzilla.redhat.com/2268315
Vendor advisory: alma — https://bugzilla.redhat.com/2268309
Vendor advisory: alma — https://bugzilla.redhat.com/2268293
Vendor advisory: alma — https://bugzilla.redhat.com/2268291
Vendor advisory: alma — https://bugzilla.redhat.com/2267804
Vendor advisory: alma — https://bugzilla.redhat.com/2267797
Vendor advisory: alma — https://bugzilla.redhat.com/2267789
Vendor advisory: alma — https://bugzilla.redhat.com/2267758
Vendor advisory: alma — https://bugzilla.redhat.com/2267724
Vendor advisory: alma — https://bugzilla.redhat.com/2267705
Vendor advisory: alma — https://bugzilla.redhat.com/2267509
Vendor advisory: alma — https://bugzilla.redhat.com/2267355
Vendor advisory: alma — https://bugzilla.redhat.com/2267185
Vendor advisory: alma — https://bugzilla.redhat.com/2267038
Vendor advisory: alma — https://bugzilla.redhat.com/2266841
Vendor advisory: alma — https://bugzilla.redhat.com/2266746
Vendor advisory: alma — https://bugzilla.redhat.com/2266446
Vendor advisory: alma — https://bugzilla.redhat.com/2266296
Vendor advisory: alma — https://bugzilla.redhat.com/2265833
Vendor advisory: alma — https://bugzilla.redhat.com/2265654
Vendor advisory: alma — https://bugzilla.redhat.com/2265646
Vendor advisory: alma — https://bugzilla.redhat.com/2263875
Vendor advisory: alma — https://bugzilla.redhat.com/2257406
Vendor advisory: alma — https://bugzilla.redhat.com/2250843
Vendor advisory: alma — https://access.redhat.com/errata/RHSA-2024:3618
Vendor advisory: alma — https://errata.almalinux.org/9/ALSA-2024-6997.html
Vendor advisory: alma — https://bugzilla.redhat.com/2301543
Vendor advisory: alma — https://bugzilla.redhat.com/2300448
Vendor advisory: alma — https://bugzilla.redhat.com/2297568
Vendor advisory: alma — https://bugzilla.redhat.com/2293685
Vendor advisory: alma — https://bugzilla.redhat.com/2293431
Vendor advisory: alma — https://bugzilla.redhat.com/2293423
Vendor advisory: alma — https://bugzilla.redhat.com/2293420
Vendor advisory: alma — https://bugzilla.redhat.com/2293364
Vendor advisory: alma — https://bugzilla.redhat.com/2293348
Vendor advisory: alma — https://bugzilla.redhat.com/2284549
Vendor advisory: alma — https://bugzilla.redhat.com/2283894
Vendor advisory: alma — https://bugzilla.redhat.com/2281677
Vendor advisory: alma — https://bugzilla.redhat.com/2278318
Vendor advisory: alma — https://bugzilla.redhat.com/2278252
Vendor advisory: alma — https://bugzilla.redhat.com/2278250
Vendor advisory: alma — https://bugzilla.redhat.com/2278248
Vendor advisory: alma — https://bugzilla.redhat.com/2278245
Vendor advisory: alma — https://bugzilla.redhat.com/2278167
Vendor advisory: alma — https://bugzilla.redhat.com/2273270
Vendor advisory: alma — https://bugzilla.redhat.com/2265271
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2023-52439
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2023-52439.html
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2024:3618
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2024:3627
Vendor advisory: redhat — https://access.redhat.com/errata/RHSA-2024:6997
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| rhel | 9 | fixed | |
| rocky | 8 | fixed | |
| sles | affected | | |
| debian | bookworm | fixed | 6.1.76-1 |
| debian | bullseye | fixed | 5.10.209-1 |
| debian | forky | fixed | 6.6.13-1 |
| debian | sid | fixed | 6.6.13-1 |
| debian | trixie | fixed | 6.6.13-1 |
References
- https://access.redhat.com/errata/RHSA-2024:6997
- https://errata.rockylinux.org/RLSA-2024:3627
- https://errata.rockylinux.org/RLSA-2024:3618
- https://www.suse.com/security/cve/CVE-2023-52439.html
- https://security-tracker.debian.org/tracker/CVE-2023-52439
- https://bugzilla.redhat.com/2265271
- https://bugzilla.redhat.com/2273270
- https://bugzilla.redhat.com/2278167
- https://bugzilla.redhat.com/2278245
- https://bugzilla.redhat.com/2278248
- https://bugzilla.redhat.com/2278250
- https://bugzilla.redhat.com/2278252
- https://bugzilla.redhat.com/2278318
- https://bugzilla.redhat.com/2281677
- https://bugzilla.redhat.com/2283894
- https://bugzilla.redhat.com/2284549
- https://bugzilla.redhat.com/2293348
- https://bugzilla.redhat.com/2293364
- https://bugzilla.redhat.com/2293420
- https://bugzilla.redhat.com/2293423
- https://bugzilla.redhat.com/2293431
- https://bugzilla.redhat.com/2293685
- https://bugzilla.redhat.com/2297568
- https://bugzilla.redhat.com/2300448
- https://bugzilla.redhat.com/2301543
Verify integrity in audit chain (admin only). AS-IS.