CVE-2023-52584: spmi: mediatek: Fix UAF on device remove
In the Linux kernel, the following vulnerability has been resolved:
spmi: mediatek: Fix UAF on device remove
The pmif driver data that contains the clocks is allocated along with spmicontroller. On device remove, spmicontroller will be freed first, and then devres , including the clocks, will be cleanup. This leads to UAF because putting the clocks will access the clocks in the pmif driver data, which is already freed along with spmicontroller.
This can be reproduced by enabling DEBUGTESTDRIVERREMOVE and building the kernel with KASAN.
Fix the UAF issue by using unmanaged clkbulkget() and putting the clocks before freeing spmicontroller.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Compensating control
In the Linux kernel SPMI MediaTek PMIF driver, use unmanaged clk_bulk_get() and put the clocks before freeing spmi_controller to prevent the use-after-free during device removal.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52584?
CVE-2023-52584 has been classified as a moderate severity vulnerability.
How do I fix CVE-2023-52584?
To fix CVE-2023-52584, update to the patched versions: linux 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
What systems are affected by CVE-2023-52584?
CVE-2023-52584 affects specific versions of the Linux kernel, including those up to version 5.10.226-1.
What causes CVE-2023-52584?
CVE-2023-52584 is caused by a use-after-free (UAF) issue in the SPMI driver related to device removal.
Is there a workaround for CVE-2023-52584?
There are no known workarounds for CVE-2023-52584 other than applying the necessary updates.