CVE-2023-52468: class: fix use-after-free in class_register()
In the Linux kernel, the following vulnerability has been resolved:
class: fix use-after-free in classregister()
The lockclasskey is still registered and can be found in lockkeyshash hlist after subsysprivate is freed in error handler path.A task who iterate over the lockkeyshash later may cause use-after-free.So fix that up and unregister the lockclasskey before kfree(cp).
On our platform, a driver fails to ksetregister because of creating duplicate filename '/class/xxx'.With Kasan enabled, it prints a invalid-access bug report.
KASAN bug report:
BUG: KASAN: invalid-access in lockdepregisterkey+0x19c/0x1bc Write of size 8 at addr 15ffff808b8c0368 by task modprobe/252 Pointer tag: [15], memory tag: [fe]
CPU: 7 PID: 252 Comm: modprobe Tainted: G W 6.6.0-mainline-maybe-dirty #1
Call trace: dumpbacktrace+0x1b0/0x1e4 showstack+0x2c/0x40 dumpstacklvl+0xac/0xe0 printreport+0x18c/0x4d8 kasanreport+0xe8/0x148 hwasanstore8noabort+0x88/0x98 lockdepregisterkey+0x19c/0x1bc classregister+0x94/0x1ec initmodule+0xbc/0xf48 [rfkill] dooneinitcall+0x17c/0x72c doinitmodule+0x19c/0x3f8 ... Memory state around the buggy address: ffffff808b8c0100: 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a ffffff808b8c0200: 8a 8a 8a 8a 8a 8a 8a 8a fe fe fe fe fe fe fe fe ffffff808b8c0300: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ^ ffffff808b8c0400: 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03
As CONFIGKASANGENERIC is not set, Kasan reports invalid-access not use-after-free here.In this case, modprobe is manipulating the corrupted lockkeyshash hlish where lockclasskey is already freed before.
It's worth noting that this only can happen if lockdep is enabled, which is not true for normal system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.133-1Fixed in 6.12.21-1Fixed in 6.12.22-1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52468?
The severity of CVE-2023-52468 has been classified as moderate due to its potential for a use-after-free vulnerability in the Linux kernel.
How do I fix CVE-2023-52468?
To fix CVE-2023-52468, upgrade your Linux kernel to a version that includes the patches provided for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2023-52468?
CVE-2023-52468 affects Linux kernel versions between 6.4.0 and 6.6.14, as well as 6.7.0 to 6.7.2.
Is CVE-2023-52468 specific to any distribution?
CVE-2023-52468 is a vulnerability in the Linux kernel and can affect multiple distributions that use vulnerable kernel versions.
What should I do if I cannot update my kernel for CVE-2023-52468?
If you cannot update your kernel for CVE-2023-52468, consider implementing additional security measures such as restricting network access to vulnerable systems.