CVE-2023-53479: cxl/acpi: Fix a use-after-free in cxl_parse_cfmws()
In the Linux kernel, the following vulnerability has been resolved:
cxl/acpi: Fix a use-after-free in cxlparsecfmws()
KASAN and KFENCE detected an user-after-free in the CXL driver. This happens in the cxldecoderadd() fail path. KASAN prints the following error:
BUG: KASAN: slab-use-after-free in cxlparsecfmws (drivers/cxl/acpi.c:299)
This happens in cxlparsecfmws(), where putdevice() is called, releasing cxld, which is accessed later.
Use the local variables in the deverr() instead of pointing to the released memory. Since the deverr() is printing a resource, change the open coded print format to use the %pr format specifier.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53479?
CVE-2023-53479 has a medium severity rating due to its potential to cause a use-after-free vulnerability in the Linux kernel.
How do I fix CVE-2023-53479?
To mitigate CVE-2023-53479, upgrade to a patched version of the Linux kernel that addresses the use-after-free vulnerability.
Which Linux kernel versions are affected by CVE-2023-53479?
CVE-2023-53479 affects Linux kernel versions from 6.0 up to 6.1.43 and from 6.2 to 6.4.8, including release candidates 6.5-rc1, 6.5-rc2, and 6.5-rc3.
What is the impact of CVE-2023-53479?
Exploiting CVE-2023-53479 can result in kernel crashes or potential escalation of privileges in the system.
Is CVE-2023-53479 related to any specific components?
CVE-2023-53479 is specifically related to the CXL driver in the Linux kernel.