CVE-2023-52503
published 2024-03-02CVE-2023-52503: In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix use-after-free vulnerability in amdtee_close_session There is a potential…
PriorityP431high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.26%
17.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
There is a potential race condition in amdtee_close_session that may
cause use-after-free in amdtee_open_session. For instance, if a session
has refcount == 1, and one thread tries to free this session via:
kref_put(&sess->refcount, destroy_session);
the reference count will get decremented, and the next step would be to
call destroy_session(). However, if in another thread,
amdtee_open_session() is called before destroy_session() has completed
execution, alloc_session() may return 'sess' that will be freed up
later in destroy_session() leading to use-after-free in
amdtee_open_session.
To fix this issue, treat decrement of sess->refcount and removal of
'sess' from session list in destroy_session() as a critical section, so
that it is executed atomically.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.64-1 (bookworm) | linux 6.1.64-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 757cc3e9ff1d72d014096399d6e2bf03974d9da1 < da7ce52a2f6c468946195b116615297d3d113a27 | da7ce52a2f6c468946195b116615297d3d113a27 |
| linux | linux | >= 757cc3e9ff1d72d014096399d6e2bf03974d9da1 < 1680c82929bc14d706065f123dab77f2f1293116 | 1680c82929bc14d706065f123dab77f2f1293116 |
| linux | linux | >= 757cc3e9ff1d72d014096399d6e2bf03974d9da1 < 60c3e7a00db954947c265b55099c21b216f2a05c | 60c3e7a00db954947c265b55099c21b216f2a05c |
| linux | linux | >= 757cc3e9ff1d72d014096399d6e2bf03974d9da1 < 1c95574350cd63bc3c5c2fa06658010768f2a0ce | 1c95574350cd63bc3c5c2fa06658010768f2a0ce |
| linux | linux | >= 757cc3e9ff1d72d014096399d6e2bf03974d9da1 < f4384b3e54ea813868bb81a861bf5b2406e15d8f | f4384b3e54ea813868bb81a861bf5b2406e15d8f |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.205-1 | 5.10.205-1 |
| linux | linux_kernel | >= 0 < 6.1.64-1 | 6.1.64-1 |
| linux | linux_kernel | >= 0 < 6.5.8-1 | 6.5.8-1 |
| linux | linux_kernel | >= 0 < 6.5.8-1 | 6.5.8-1 |
| linux | linux_kernel | >= 5.11 < 5.15.136 | 5.15.136 |
| linux | linux_kernel | >= 5.16 < 6.1.59 | 6.1.59 |
| linux | linux_kernel | >= 5.6 < 5.10.199 | 5.10.199 |
| linux | linux_kernel | >= 6.2 < 6.5.8 | 6.5.8 |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.0HIGH
vendor_debian7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
vendor_redhat·2024-03-02·CVSS 7.0
CVE-2023-52503 [HIGH] CWE-416 kernel: tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
kernel: tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
In the Linux kernel, the following vulnerability has been resolved:
tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
There is a potential race condition in amdtee_close_session that may
cause use-after-free in amdtee_open_session. For instance, if a session
has refcount == 1, and one thread tries to free this session via:
kref_put(&sess->refcount, destroy_session);
the reference count will get decremented, and the next step would be to
call destroy_session(). However, if in another thread,
amdtee_open_session() is called before destroy_session() has completed
execution, alloc_session() may return 'sess' that will be freed up
later in destroy_session() leading to use-after-free in
amdtee_open
Debian
CVE-2023-52503: linux - In the Linux kernel, the following vulnerability has been resolved: tee: amdtee...
vendor_debian·2023·CVSS 7.0
CVE-2023-52503 [HIGH] CVE-2023-52503: linux - In the Linux kernel, the following vulnerability has been resolved: tee: amdtee...
In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix use-after-free vulnerability in amdtee_close_session There is a potential race condition in amdtee_close_session that may cause use-after-free in amdtee_open_session. For instance, if a session has refcount == 1, and one thread tries to free this session via: kref_put(&sess->refcount, destroy_session); the reference count will get decremented, and the next step would be to call destroy_session(). However, if in another thread, amdtee_open_session() is called before destroy_session() has completed execution, alloc_session() may return 'sess' that will be freed up later in destroy_session() leading to use-after-free in amdtee_open_session. To fix this issue, treat decrement of sess->refcount and removal of '
GHSA
GHSA-c5gm-r7c3-j9cp: In the Linux kernel, the following vulnerability has been resolved:
tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
There is a
ghsa_unreviewed·2024-03-03
CVE-2023-52503 [HIGH] CWE-416 GHSA-c5gm-r7c3-j9cp: In the Linux kernel, the following vulnerability has been resolved:
tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
There is a
In the Linux kernel, the following vulnerability has been resolved:
tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
There is a potential race condition in amdtee_close_session that may
cause use-after-free in amdtee_open_session. For instance, if a session
has refcount == 1, and one thread tries to free this session via:
kref_put(&sess->refcount, destroy_session);
the reference count will get decremented, and the next step would be to
call destroy_session(). However, if in another thread,
amdtee_open_session() is called before destroy_session() has completed
execution, alloc_session() may return 'sess' that will be freed up
later in destroy_session() leading to use-after-free in
amdtee_open_session.
To fix this issue, treat decrement of sess->refcount and removal
OSV
CVE-2023-52503: In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix use-after-free vulnerability in amdtee_close_session There is a p
osv·2024-03-02·CVSS 7.0
CVE-2023-52503 [HIGH] CVE-2023-52503: In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix use-after-free vulnerability in amdtee_close_session There is a p
In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix use-after-free vulnerability in amdtee_close_session There is a potential race condition in amdtee_close_session that may cause use-after-free in amdtee_open_session. For instance, if a session has refcount == 1, and one thread tries to free this session via: kref_put(&sess->refcount, destroy_session); the reference count will get decremented, and the next step would be to call destroy_session(). However, if in another thread, amdtee_open_session() is called before destroy_session() has completed execution, alloc_session() may return 'sess' that will be freed up later in destroy_session() leading to use-after-free in amdtee_open_session. To fix this issue, treat decrement of sess->refcount and removal of '
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/1680c82929bc14d706065f123dab77f2f1293116https://git.kernel.org/stable/c/1c95574350cd63bc3c5c2fa06658010768f2a0cehttps://git.kernel.org/stable/c/60c3e7a00db954947c265b55099c21b216f2a05chttps://git.kernel.org/stable/c/da7ce52a2f6c468946195b116615297d3d113a27https://git.kernel.org/stable/c/f4384b3e54ea813868bb81a861bf5b2406e15d8fhttps://git.kernel.org/stable/c/1680c82929bc14d706065f123dab77f2f1293116https://git.kernel.org/stable/c/1c95574350cd63bc3c5c2fa06658010768f2a0cehttps://git.kernel.org/stable/c/60c3e7a00db954947c265b55099c21b216f2a05chttps://git.kernel.org/stable/c/da7ce52a2f6c468946195b116615297d3d113a27https://git.kernel.org/stable/c/f4384b3e54ea813868bb81a861bf5b2406e15d8f
2024-03-02
Published