CVE-2023-52847: media: bttv: fix use after free error due to btv->timeout timer
In the Linux kernel, the following vulnerability has been resolved:
media: bttv: fix use after free error due to btv->timeout timer
The Linux kernel CVE team has assigned CVE-2023-52847 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052113-CVE-2023-52847-a551@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
media: bttv: fix use after free error due to btv->timeout timer
There may be some a race condition between timer function bttvirqtimeout and bttvremove. The timer is setup in probe and there is no timerdelete operation in remove function. When it hit kfree btv, the function might still be invoked, which will cause use after free bug.
This bug is found by static analysis, it may be false positive.
Fix it by adding deltimersync invoking to the remove function.
cpu0 cpu1 bttvprobe ->timersetup ->bttvsetdma ->modtimer; bttvremove ->kfree(btv); ->bttvirqtimeout ->USE btv
— NVD
Linux Kernel could allow a local authenticated attacker to execute arbitrary code on the system, caused by a use-after-free flaw due to btv->timeout timer. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.19.299 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.261 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.201 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.139 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.63 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.5.12 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7 - Configuration
Fix the use-after-free: when freeing btv in bttv_remove (kfree(btv)), ensure the btv->timeout timer is stopped with del_timer_sync before any code path can invoke bttv_irq_timeout.
Linux kernel media: bttv del_timer_sync (invoke in remove) = Add del_timer_sync(...) in bttv_remove to stop and synchronize btv->timeout timer before freeing btv - Compensating control
If this is a suspected false positive from static analysis, validate whether the btv->timeout timer can race with bttv_remove in your environment before applying the code-level change (still safe to apply the synchronization fix).
- Compensating control
Because the issue is a local authenticated attacker leading to arbitrary code execution, restrict access to the affected bttv functionality/driver usage to trusted/authorized users only.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52847?
CVE-2023-52847 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2023-52847?
To fix CVE-2023-52847, update your Linux kernel to a version greater than or equal to the specified remedies for your distribution.
What versions of the Linux kernel are affected by CVE-2023-52847?
CVE-2023-52847 affects multiple versions of the Linux kernel including those lower than 4.19.299, 5.4.261, 5.10.201, 5.15.139, 6.1.63, 6.5.12, 6.6.2, and 6.7.
Who is impacted by CVE-2023-52847?
Users and administrators running vulnerable versions of the Linux kernel may be impacted by CVE-2023-52847.
What exploitation risks are associated with CVE-2023-52847?
CVE-2023-52847 can potentially allow an attacker to exploit the use after free vulnerability for unauthorized access or control over affected systems.