Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2023-52439

Опубликовано: 20 фев. 2024
Источник: nvd
CVSS3: 7.8
EPSS Низкий

Описание

In the Linux kernel, the following vulnerability has been resolved:

uio: Fix use-after-free in uio_open

core-1 core-2

uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev)

In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then:

  1. After core-1 kfree idev, the core-2 will do use-after-free for idev.
  2. When core-2 do uio_release and put_device, the idev will be double freed.

To address this issue, we can get idev atomic & inc idev reference with minor_lock.

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Версия от 4.18.0 (исключая) до 4.19.306 (исключая)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Версия от 4.20.0 (включая) до 5.4.268 (исключая)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Версия от 5.5.0 (включая) до 5.10.209 (исключая)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Версия от 5.11.0 (включая) до 5.15.148 (исключая)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Версия от 5.16.0 (включая) до 6.1.74 (исключая)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Версия от 6.2.0 (включая) до 6.6.13 (исключая)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Версия от 6.7.0 (включая) до 6.7.1 (исключая)
cpe:2.3:o:linux:linux_kernel:4.18:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.18:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.18:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.18:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.18:rc8:*:*:*:*:*:*

EPSS

Процентиль: 1%
0.00011
Низкий

7.8 High

CVSS3

Дефекты

CWE-415

Связанные уязвимости

CVSS3: 7.8
ubuntu
больше 1 года назад

In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock.

CVSS3: 7
redhat
больше 1 года назад

In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1core-2 ------------------------------------------------------- uio_unregister_deviceuio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock.

CVSS3: 7.8
debian
больше 1 года назад

In the Linux kernel, the following vulnerability has been resolved: u ...

CVSS3: 7.8
github
больше 1 года назад

In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock.

CVSS3: 7.8
fstec
больше 1 года назад

Уязвимость функции uio_open() в модуле drivers/uio/uio.c драйвера uio ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

EPSS

Процентиль: 1%
0.00011
Низкий

7.8 High

CVSS3

Дефекты

CWE-415