CVE-2023-52629: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
In the Linux kernel, the following vulnerability has been resolved:
sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
The original code puts flushwork() before timershutdownsync() in switchdrvremove(). Although we use flushwork() to stop the worker, it could be rescheduled in switchtimer(). As a result, a use-after-free bug can occur. The details are shown below:
(cpu 0) | (cpu 1) switchdrvremove() | flushwork() | ... | switchtimer // timer | schedulework(&psw->work) timershutdownsync() | ... | switchworkhandler // worker kfree(psw) // free | | psw->state = 0 // use
This patch puts timershutdownsync() before flushwork() to mitigate the bugs. As a result, the worker and timer will be stopped safely before the deallocate operations.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52629?
CVE-2023-52629 is a moderate severity vulnerability that can lead to a use-after-free condition in the Linux kernel.
What versions of Linux are affected by CVE-2023-52629?
CVE-2023-52629 affects Linux versions up to and including 5.10.234-1 and 6.1.128-1.
How do I fix CVE-2023-52629?
To fix CVE-2023-52629, upgrade to the Linux kernel versions 6.12.12-1 or 6.12.17-1.
What component of the Linux kernel does CVE-2023-52629 impact?
CVE-2023-52629 impacts the switch driver within the Linux kernel.
What is the nature of the vulnerability described in CVE-2023-52629?
CVE-2023-52629 is a use-after-free vulnerability caused by improper cleanup operations in the kernel.