cbcvebase.
CVE-2023-52629
published 2024-03-29

CVE-2023-52629: In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug The original code…

PriorityP339high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EPSS
0.24%
15.3th percentile
In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug The original code puts flush_work() before timer_shutdown_sync() in switch_drv_remove(). Although we use flush_work() to stop the worker, it could be rescheduled in switch_timer(). As a result, a use-after-free bug can occur. The details are shown below: (cpu 0) | (cpu 1) switch_drv_remove() | flush_work() | ... | switch_timer // timer | schedule_work(&psw->work) timer_shutdown_sync() | ... | switch_work_handler // worker kfree(psw) // free | | psw->state = 0 // use This patch puts timer_shutdown_sync() before flush_work() to mitigate the bugs. As a result, the worker and timer will be stopped safely before the deallocate operations.

Affected

12 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.5.6-1 (forky)linux 6.5.6-1 (forky)
linuxlinux
linuxlinux>= 9f5e8eee5cfe1328660c71812d87c2a67bda389f < 610dbd8ac271aa36080aac50b928d700ee3fe4de610dbd8ac271aa36080aac50b928d700ee3fe4de
linuxlinux>= 9f5e8eee5cfe1328660c71812d87c2a67bda389f < 246f80a0b17f8f582b2c0996db02998239057c65246f80a0b17f8f582b2c0996db02998239057c65
linuxlinux_kernel>= 0 < 6.5.6-16.5.6-1
linuxlinux_kernel>= 0 < 6.5.6-16.5.6-1
linuxlinux_kernel>= 0 < 5.4.0-193.2135.4.0-193.213
linuxlinux_kernel>= 0 < 5.15.0-119.1295.15.0-119.129
linuxlinux_kernel>= 0 < 4.4.0-258.2924.4.0-258.292
linuxlinux_kernel>= 0 < 4.15.0-228.2404.15.0-228.240
linuxlinux_kernel>= 2.6.20 < 6.5.46.5.4
msrccbl2_kernel_5.15.182.1-1_on_cbl_mariner_2.0

CVSS provenance

nvdv3.18.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv8.4HIGH
vendor_debian8.4HIGH
vendor_msrc8.4HIGH
vendor_redhat8.4HIGH
vendor_ubuntu8.4HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.