cbcvebase.
CVE-2023-52584
published 2024-03-06

CVE-2023-52584: In the Linux kernel, the following vulnerability has been resolved: spmi: mediatek: Fix UAF on device remove The pmif driver data that contains the clocks is…

PriorityP413low3.8CVSS 3.1
AVNACLPRHUINSUCLILAN
EPSS
0.56%
43.9th percentile
In the Linux kernel, the following vulnerability has been resolved: spmi: mediatek: Fix UAF on device remove The pmif driver data that contains the clocks is allocated along with spmi_controller. On device remove, spmi_controller will be freed first, and then devres , including the clocks, will be cleanup. This leads to UAF because putting the clocks will access the clocks in the pmif driver data, which is already freed along with spmi_controller. This can be reproduced by enabling DEBUG_TEST_DRIVER_REMOVE and building the kernel with KASAN. Fix the UAF issue by using unmanaged clk_bulk_get() and putting the clocks before freeing spmi_controller.

Affected

13 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.82-1 (bookworm)linux 6.1.82-1 (bookworm)
linuxlinux
linuxlinux>= b45b3ccef8c063d21eb746d85337eaf71f6b5f07 < 521f28eedd6b14228c46e3b81e3bf9b90c2818d8521f28eedd6b14228c46e3b81e3bf9b90c2818d8
linuxlinux>= b45b3ccef8c063d21eb746d85337eaf71f6b5f07 < f8dcafcb54632536684336161da8bdd52120f95ef8dcafcb54632536684336161da8bdd52120f95e
linuxlinux>= b45b3ccef8c063d21eb746d85337eaf71f6b5f07 < 9a3881b1f07db1bb55cb0108e6f05cfd027eaf2e9a3881b1f07db1bb55cb0108e6f05cfd027eaf2e
linuxlinux>= b45b3ccef8c063d21eb746d85337eaf71f6b5f07 < e821d50ab5b956ed0effa49faaf29912fd4106d9e821d50ab5b956ed0effa49faaf29912fd4106d9
linuxlinux_kernel< 6.1.776.1.77
linuxlinux_kernel>= 0 < 6.1.82-16.1.82-1
linuxlinux_kernel>= 0 < 6.7.7-16.7.7-1
linuxlinux_kernel>= 0 < 6.7.7-16.7.7-1
linuxlinux_kernel>= 6.2 < 6.6.166.6.16
linuxlinux_kernel>= 6.7 < 6.7.46.7.4
msrccbl2_kernel_5.15.182.1-1_on_cbl_mariner_2.0

CVSS provenance

nvdv3.13.8LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian3.8LOW
vendor_msrc3.8LOW
vendor_redhat3.8LOW
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.