CVE-2023-53515
Description
In the Linux kernel, the following vulnerability has been resolved: virtio-mmio: don't break lifecycle of vm_dev vm_dev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is correct. Allocating the vm_dev struct with devres totally breaks this protection, though. Instead of waiting for the vm_dev release callback, the memory is freed when the platform_device is removed. Resulting in a use-after-free when finally the callback is to be called. To easily see the problem, compile the kernel with CONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs. The fix is easy, don't use devres in this case. Found during my research about object lifetime problems.
How to fix
- linux linux_kernel4.19.293, 5.4.255, 5.10.192, 5.15.128, 6.1.47, 6.4.12 or later
- git.kernel.org/stable/c/2dcb368fe5a8eee498ca75c93a18ce2f3b0d6a8e
- git.kernel.org/stable/c/3ff54d904fafabd0912796785e53cce4e69ca123
- git.kernel.org/stable/c/55c91fedd03d7b9cf0c5199b2eb12b9b8e95281a
- git.kernel.org/stable/c/5b7d5c2dd664eb8b9a06ecbc06e28d39359c422e
- git.kernel.org/stable/c/97a2d55ead76358245b446efd87818e919196d7a
- git.kernel.org/stable/c/af5818c35173e096085c6ae2e3aac605d3d15e41
- git.kernel.org/stable/c/b788ad3b2468512339c05f23692e36860264e674
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 4.15.1 ≤ v < 4.19.293, 4.20 ≤ v < 5.4.255, 5.5 ≤ v < 5.10.192, 5.11 ≤ v < 5.15.128, 5.16 ≤ v < 6.1.47, 6.2 ≤ v < 6.4.12, 4.15, 6.5 | 4.19.293, 5.4.255, 5.10.192, 5.15.128, 6.1.47, 6.4.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.