sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug The original code puts flush_work() before timer_shutdown_sync() in switch_drv_remove(). Although we use flush_work() to stop the worker, it could be rescheduled in switch_timer(). As a result, a use-after-free bug can occur. The details are shown below: (cpu 0) | (cpu 1) switch_drv_remove() | flush_work() | ... | switch_timer // timer | schedule_work(&psw->work) timer_shutdown_sync() | ... | switch_work_handler // worker kfree(psw) // free | | psw->state = 0 // use This patch puts timer_shutdown_sync() before flush_work() to mitigate the bugs. As a result, the worker and timer will be stopped safely before the deallocate operations.
CVE-2023-52629
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2023-52629
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "9f5e8eee5cfe1328660c71812d87c2a67bda389f",
"lessThan": "ff635d1f143b55fa005e9e43b16e6d8f677e90a5",
"versionType": "git"
},
{
"status": "affected",
"version": "9f5e8eee5cfe1328660c71812d87c2a67bda389f",
"lessThan": "610dbd8ac271aa36080aac50b928d700ee3fe4de",
"versionType": "git"
},
{
"status": "affected",
"version": "9f5e8eee5cfe1328660c71812d87c2a67bda389f",
"lessThan": "246f80a0b17f8f582b2c0996db02998239057c65",
"versionType": "git"
}
],
"programFiles": [
"arch/sh/drivers/push-switch.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.20"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.20",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.5.4",
"versionType": "semver",
"lessThanOrEqual": "6.5.*"
},
{
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/sh/drivers/push-switch.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2023-52629
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #8210 · Revision 1
- Added to Heist Feed
- Publisher date