linux-cve-announce.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: CVE-2023-52439: uio: Fix use-after-free in uio_open
Date: Tue, 20 Feb 2024 19:34:26 +0100	[thread overview]
Message-ID: <2024022026-wobbling-jumbo-748e@gregkh> (raw)

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

uio: Fix use-after-free in uio_open

core-1				core-2
-------------------------------------------------------
uio_unregister_device		uio_open
				idev = idr_find()
device_unregister(&idev->dev)
put_device(&idev->dev)
uio_device_release
				get_device(&idev->dev)
kfree(idev)
uio_free_minor(minor)
				uio_release
				put_device(&idev->dev)
				kfree(idev)
-------------------------------------------------------

In the core-1 uio_unregister_device(), the device_unregister will kfree
idev when the idev->dev kobject ref is 1. But after core-1
device_unregister, put_device and before doing kfree, the core-2 may
get_device. Then:
1. After core-1 kfree idev, the core-2 will do use-after-free for idev.
2. When core-2 do uio_release and put_device, the idev will be double
   freed.

To address this issue, we can get idev atomic & inc idev reference with
minor_lock.

The Linux kernel CVE team has assigned CVE-2023-52439 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.18 with commit 57c5f4df0a5a and fixed in 4.19.306 with commit 3174e0f7de1b
	Issue introduced in 4.18 with commit 57c5f4df0a5a and fixed in 5.4.268 with commit e93da893d52d
	Issue introduced in 4.18 with commit 57c5f4df0a5a and fixed in 5.10.209 with commit 5e0be1229ae1
	Issue introduced in 4.18 with commit 57c5f4df0a5a and fixed in 5.15.148 with commit 5cf604ee538e
	Issue introduced in 4.18 with commit 57c5f4df0a5a and fixed in 6.1.74 with commit 17a8519cb359
	Issue introduced in 4.18 with commit 57c5f4df0a5a and fixed in 6.6.13 with commit 35f102607054
	Issue introduced in 4.18 with commit 57c5f4df0a5a and fixed in 6.7.1 with commit 913205930da6
	Issue introduced in 4.18 with commit 57c5f4df0a5a and fixed in 6.8-rc1 with commit 0c9ae0b86050

Please see https://www.kernel.org or a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52439
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/uio/uio.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3174e0f7de1ba392dc191625da83df02d695b60c
	https://git.kernel.org/stable/c/e93da893d52d82d57fc0db2ca566024e0f26ff50
	https://git.kernel.org/stable/c/5e0be1229ae199ebb90b33102f74a0f22d152570
	https://git.kernel.org/stable/c/5cf604ee538ed0c467abe3b4cda5308a6398f0f7
	https://git.kernel.org/stable/c/17a8519cb359c3b483fb5c7367efa9a8a508bdea
	https://git.kernel.org/stable/c/35f102607054faafe78d2a6994b18d5d9d6e92ad
	https://git.kernel.org/stable/c/913205930da6213305616ac539447702eaa85e41
	https://git.kernel.org/stable/c/0c9ae0b8605078eafc3bea053cc78791e97ba2e2

                 reply	other threads:[~2024-02-20 18:34 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2024022026-wobbling-jumbo-748e@gregkh \
    --to=gregkh@linuxfoundation.org \
    --cc=cve@kernel.org \
    --cc=linux-cve-announce@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).