CVE-2023-52439
Description
In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock.
How to fix
- linux linux_kernel4.19.306, 5.4.268, 5.10.209, 5.15.148, 6.1.74, 6.6.13, 6.7.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 4.18.0 < v < 4.19.306, 4.20.0 ≤ v < 5.4.268, 5.5.0 ≤ v < 5.10.209, 5.11.0 ≤ v < 5.15.148, 5.16.0 ≤ v < 6.1.74, 6.2.0 ≤ v < 6.6.13, 6.7.0 ≤ v < 6.7.1, 4.18 | 4.19.306, 5.4.268, 5.10.209, 5.15.148, 6.1.74, 6.6.13, 6.7.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.