lib: cpu_rmap: Avoid use after free on rmap->obj array entries (Linux Linux)

CVE-2023-53484
HIGH 7.8

En bref

Source
NVD
EPSS
EPSS 0.16 % · centile 6 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Modified

Description

In the Linux kernel, the following vulnerability has been resolved: lib: cpu_rmap: Avoid use after free on rmap->obj array entries When calling irq_set_affinity_notifier() with NULL at the notify argument, it will cause freeing of the glue pointer in the corresponding array entry but will leave the pointer in the array. A subsequent call to free_irq_cpu_rmap() will try to free this entry again leading to possible use after free. Fix that by setting NULL to the array entry and checking that we have non-zero at the array entry when iterating over the array in free_irq_cpu_rmap(). The current code does not suffer from this since there are no cases where irq_set_affinity_notifier(irq, NULL) (note the NULL passed for the notify arg) is called, followed by a call to free_irq_cpu_rmap() so we don't hit and issue. Subsequent patches in this series excersize this flow, hence the required fix.

Faiblesses (CWE)

  • CWE-416 — Utilisation après libération

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Linux · Linuxaffected 896f97ea95c1d29c0520ee0766b66b7f64cb967c < 981f339d2905b6a92ef59358158b326493aecac5 ; affected 896f97ea95c1d29c0520ee0766b66b7f64cb967c < d1308bd0b24cb1d78fa2747d5fa3e055cc628a48 ; affected 896f97ea95c1d29c0520ee0766b66b7f64cb967c < cc2d2b3dbfb0ba57bc027fb7e1121250c50e4000 ; affected 896f97ea95c1d29c0520ee0766b66b7f64cb967c < f748e15253833b771acbede14ea98f50831ac289 ; affected 896f97ea95c1d29c0520ee0766b66b7f64cb967c < c6ed54dd90698dc0744d669524cc1c122ded8a16 ; affected 896f97ea95c1d29c0520ee0766b66b7f64cb967c < c9115f49cf260d24d8b5f2d9a4b63cb31a627bb4
Linux · Linuxaffected 3.8 ; unaffected 0 < 3.8 ; unaffected 4.14.316 ≤ 4.14.* ; unaffected 4.19.284 ≤ 4.19.* ; unaffected 5.4.244 ≤ 5.4.* ; unaffected 5.10.181 ≤ 5.10.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD