CVE-2023-52856
published 2024-05-21CVE-2023-52856: In the Linux kernel, the following vulnerability has been resolved: drm/bridge: lt8912b: Fix crash on bridge detach The lt8912b driver, in its bridge detach…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.24%
14.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
drm/bridge: lt8912b: Fix crash on bridge detach
The lt8912b driver, in its bridge detach function, calls
drm_connector_unregister() and drm_connector_cleanup().
drm_connector_unregister() should be called only for connectors
explicitly registered with drm_connector_register(), which is not the
case in lt8912b.
The driver's drm_connector_funcs.destroy hook is set to
drm_connector_cleanup().
Thus the driver should not call either drm_connector_unregister() nor
drm_connector_cleanup() in its lt8912_bridge_detach(), as they cause a
crash on bridge detach:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=00000000858f3000
[0000000000000000] pgd=0800000085918003, p4d=0800000085918003, pud=0800000085431003, pmd=0000000000000000
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in: tidss(-) display_connector lontium_lt8912b tc358768 panel_lvds panel_simple drm_dma_helper drm_kms_helper drm drm_panel_orientation_quirks
CPU: 3 PID: 462 Comm: rmmod Tainted: G W 6.5.0-rc2+ #2
Hardware name: Toradex Verdin AM62 on Verdin Development Board (DT)
pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : drm_connector_cleanup+0x78/0x2d4 [drm]
lr : lt8912_bridge_detach+0x54/0x6c [lontium_lt8912b]
sp : ffff800082ed3a90
x29: ffff800082ed3a90 x28: ffff0000040c1940 x27: 0000000000000000
x26: 0000000000000000 x25: dead000000000122 x24: dead000000000122
x23: dead000000000100 x22: ffff000003fb6388 x21: 0000000000000000
x20: 0000000000000000 x19: ffff000003fb6260 x18: fffffffffffe56e8
x17: 0000000000000000 x16: 00100
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.64-1 (bookworm) | linux 6.1.64-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 30e2ae943c260036ea494b601343f6ed5ce7bc60 < 42071feab712ba2a139b8928f7e0f8d3a6fc719e | 42071feab712ba2a139b8928f7e0f8d3a6fc719e |
| linux | linux | >= 30e2ae943c260036ea494b601343f6ed5ce7bc60 < 7bf0cb8f40280a85034990dfe42be8ca8f80f37a | 7bf0cb8f40280a85034990dfe42be8ca8f80f37a |
| linux | linux | >= 30e2ae943c260036ea494b601343f6ed5ce7bc60 < fcd9895e365474709844eeb31cfe53d912c3596e | fcd9895e365474709844eeb31cfe53d912c3596e |
| linux | linux | >= 30e2ae943c260036ea494b601343f6ed5ce7bc60 < b65e3249f3ca96e3c736af889461d80d675feab6 | b65e3249f3ca96e3c736af889461d80d675feab6 |
| linux | linux | >= 30e2ae943c260036ea494b601343f6ed5ce7bc60 < 44283993144a03af9df31934d6c32bbd42d1a347 | 44283993144a03af9df31934d6c32bbd42d1a347 |
| linux | linux_kernel | >= 0 < 6.1.64-1 | 6.1.64-1 |
| linux | linux_kernel | >= 0 < 6.6.8-1 | 6.6.8-1 |
| linux | linux_kernel | >= 0 < 6.6.8-1 | 6.6.8-1 |
| linux | linux_kernel | >= 5.13 < 5.15.139 | 5.15.139 |
| linux | linux_kernel | >= 5.16 < 6.1.63 | 6.1.63 |
| linux | linux_kernel | >= 6.2 < 6.5.12 | 6.5.12 |
| linux | linux_kernel | >= 6.6 < 6.6.2 | 6.6.2 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: drm/bridge: lt8912b: Fix crash on bridge detach
vendor_redhat·2024-05-21·CVSS 5.5
CVE-2023-52856 [MEDIUM] CWE-476 kernel: drm/bridge: lt8912b: Fix crash on bridge detach
kernel: drm/bridge: lt8912b: Fix crash on bridge detach
In the Linux kernel, the following vulnerability has been resolved:
drm/bridge: lt8912b: Fix crash on bridge detach
The lt8912b driver, in its bridge detach function, calls
drm_connector_unregister() and drm_connector_cleanup().
drm_connector_unregister() should be called only for connectors
explicitly registered with drm_connector_register(), which is not the
case in lt8912b.
The driver's drm_connector_funcs.destroy hook is set to
drm_connector_cleanup().
Thus the driver should not call either drm_connector_unregister() nor
drm_connector_cleanup() in its lt8912_bridge_detach(), as they cause a
crash on bridge detach:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x00000000
Debian
CVE-2023-52856: linux - In the Linux kernel, the following vulnerability has been resolved: drm/bridge:...
vendor_debian·2023·CVSS 5.5
CVE-2023-52856 [MEDIUM] CVE-2023-52856: linux - In the Linux kernel, the following vulnerability has been resolved: drm/bridge:...
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: lt8912b: Fix crash on bridge detach The lt8912b driver, in its bridge detach function, calls drm_connector_unregister() and drm_connector_cleanup(). drm_connector_unregister() should be called only for connectors explicitly registered with drm_connector_register(), which is not the case in lt8912b. The driver's drm_connector_funcs.destroy hook is set to drm_connector_cleanup(). Thus the driver should not call either drm_connector_unregister() nor drm_connector_cleanup() in its lt8912_bridge_detach(), as they cause a crash on bridge detach: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET =
GHSA
GHSA-3qr9-g9f2-22xh: In the Linux kernel, the following vulnerability has been resolved:
drm/bridge: lt8912b: Fix crash on bridge detach
The lt8912b driver, in its bridg
ghsa_unreviewed·2024-05-21
CVE-2023-52856 [MEDIUM] CWE-476 GHSA-3qr9-g9f2-22xh: In the Linux kernel, the following vulnerability has been resolved:
drm/bridge: lt8912b: Fix crash on bridge detach
The lt8912b driver, in its bridg
In the Linux kernel, the following vulnerability has been resolved:
drm/bridge: lt8912b: Fix crash on bridge detach
The lt8912b driver, in its bridge detach function, calls
drm_connector_unregister() and drm_connector_cleanup().
drm_connector_unregister() should be called only for connectors
explicitly registered with drm_connector_register(), which is not the
case in lt8912b.
The driver's drm_connector_funcs.destroy hook is set to
drm_connector_cleanup().
Thus the driver should not call either drm_connector_unregister() nor
drm_connector_cleanup() in its lt8912_bridge_detach(), as they cause a
crash on bridge detach:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
OSV
CVE-2023-52856: In the Linux kernel, the following vulnerability has been resolved: drm/bridge: lt8912b: Fix crash on bridge detach The lt8912b driver, in its bridge
osv·2024-05-21·CVSS 5.5
CVE-2023-52856 [MEDIUM] CVE-2023-52856: In the Linux kernel, the following vulnerability has been resolved: drm/bridge: lt8912b: Fix crash on bridge detach The lt8912b driver, in its bridge
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: lt8912b: Fix crash on bridge detach The lt8912b driver, in its bridge detach function, calls drm_connector_unregister() and drm_connector_cleanup(). drm_connector_unregister() should be called only for connectors explicitly registered with drm_connector_register(), which is not the case in lt8912b. The driver's drm_connector_funcs.destroy hook is set to drm_connector_cleanup(). Thus the driver should not call either drm_connector_unregister() nor drm_connector_cleanup() in its lt8912_bridge_detach(), as they cause a crash on bridge detach: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET =
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/42071feab712ba2a139b8928f7e0f8d3a6fc719ehttps://git.kernel.org/stable/c/44283993144a03af9df31934d6c32bbd42d1a347https://git.kernel.org/stable/c/7bf0cb8f40280a85034990dfe42be8ca8f80f37ahttps://git.kernel.org/stable/c/b65e3249f3ca96e3c736af889461d80d675feab6https://git.kernel.org/stable/c/fcd9895e365474709844eeb31cfe53d912c3596ehttps://git.kernel.org/stable/c/42071feab712ba2a139b8928f7e0f8d3a6fc719ehttps://git.kernel.org/stable/c/44283993144a03af9df31934d6c32bbd42d1a347https://git.kernel.org/stable/c/7bf0cb8f40280a85034990dfe42be8ca8f80f37ahttps://git.kernel.org/stable/c/b65e3249f3ca96e3c736af889461d80d675feab6https://git.kernel.org/stable/c/fcd9895e365474709844eeb31cfe53d912c3596e
2024-05-21
Published