CVE-2023-53123

published 2025-05-02

CVE-2023-53123: In the Linux kernel, the following vulnerability has been resolved: PCI: s390: Fix use-after-free of PCI resources with per-function hotplug On s390 PCI…

Priority P3 38 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

In the Linux kernel, the following vulnerability has been resolved:

PCI: s390: Fix use-after-free of PCI resources with per-function hotplug

On s390 PCI functions may be hotplugged individually even when they
belong to a multi-function device. In particular on an SR-IOV device VFs
may be removed and later re-added.

In commit a50297cf8235 ("s390/pci: separate zbus creation from
scanning") it was missed however that struct pci_bus and struct
zpci_bus's resource list retained a reference to the PCI functions MMIO
resources even though those resources are released and freed on
hot-unplug. These stale resources may subsequently be claimed when the
PCI function re-appears resulting in use-after-free.

One idea of fixing this use-after-free in s390 specific code that was
investigated was to simply keep resources around from the moment a PCI
function first appeared until the whole virtual PCI bus created for
a multi-function device disappears. The problem with this however is
that due to the requirement of artificial MMIO addreesses (address
cookies) extra logic is then needed to keep the address cookies
compatible on re-plug. At the same time the MMIO resources semantically
belong to the PCI function so tying their lifecycle to the function
seems more logical.

Instead a simpler approach is to remove the resources of an individually
hot-unplugged PCI function from the PCI bus's resource list while
keeping the resources of other PCI functions on the PCI bus untouched.

This is done by introducing pci_bus_remove_resource() to remove an
individual resource. Similarly the resource also needs to be removed
from the struct zpci_bus's resource list. It turns out however, that
there is really no need to add the MMIO resources to the struct
zpci_bus's resource list at all and instead we can simply use the
zpci_bar_struct's resource pointer directly.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.25-1 (bookworm)	linux 6.1.25-1 (bookworm)
linux	linux	—	—
linux	linux	>= a50297cf8235b062bcdeaa8b1dad58e69d3e1b43 < 437bb839e36cc9f35adc6d2a2bf113b7a0fc9985	437bb839e36cc9f35adc6d2a2bf113b7a0fc9985
linux	linux	>= a50297cf8235b062bcdeaa8b1dad58e69d3e1b43 < a2410d0c3d2d714ed968a135dfcbed6aa3ff7027	a2410d0c3d2d714ed968a135dfcbed6aa3ff7027
linux	linux	>= a50297cf8235b062bcdeaa8b1dad58e69d3e1b43 < b99ebf4b62774e690e73a551cf5fbf6f219bdd96	b99ebf4b62774e690e73a551cf5fbf6f219bdd96
linux	linux	>= a50297cf8235b062bcdeaa8b1dad58e69d3e1b43 < ab909509850b27fd39b8ba99e44cda39dbc3858c	ab909509850b27fd39b8ba99e44cda39dbc3858c
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.1.25-1	6.1.25-1
linux	linux_kernel	>= 0 < 6.1.25-1	6.1.25-1
linux	linux_kernel	>= 0 < 6.1.25-1	6.1.25-1
linux	linux_kernel	>= 5.13 < 5.15.104	5.15.104
linux	linux_kernel	>= 5.16 < 6.1.21	6.1.21
linux	linux_kernel	>= 6.2 < 6.2.8	6.2.8

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

osv 7.8 HIGH

vendor_debian 7.8 HIGH

vendor_redhat 7.8 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-416