We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)
Bugpilot (Bug tracking)

Ok

THREATINT CVE Home CVE Diag Help
PUBLISHED

CVE-2023-52564

Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"

Reserved:2024-03-02
Published:2024-03-02
Updated:2024-04-04

Description

In the Linux kernel, the following vulnerability has been resolved: Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux" This reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239. The commit above is reverted as it did not solve the original issue. gsm_cleanup_mux() tries to free up the virtual ttys by calling gsm_dlci_release() for each available DLCI. There, dlci_put() is called to decrease the reference counter for the DLCI via tty_port_put() which finally calls gsm_dlci_free(). This already clears the pointer which is being checked in gsm_cleanup_mux() before calling gsm_dlci_release(). Therefore, it is not necessary to clear this pointer in gsm_cleanup_mux() as done in the reverted commit. The commit introduces a null pointer dereference: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x156/0x420 ? search_exception_tables+0x37/0x50 ? fixup_exception+0x21/0x310 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x26/0x30 ? tty_port_put+0x19/0xa0 gsmtty_cleanup+0x29/0x80 [n_gsm] release_one_tty+0x37/0xe0 process_one_work+0x1e6/0x3e0 worker_thread+0x4c/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe1/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> The actual issue is that nothing guards dlci_put() from being called multiple times while the tty driver was triggered but did not yet finished calling gsm_dlci_free().

Product status

Default status
unaffected

8fc0eabaa73b before 6d5c8862932d
affected

5138c228311a before a48d2bcd23f2
affected

9615ca54bc13 before c61d0b87a702
affected

9b9c8195f3f0 before 2bff660e0ff3
affected

9b9c8195f3f0 before 29346e217b8a
affected

Default status
affected

6.5
affected

Any version before 6.5
unaffected

5.10.198
unaffected

5.15.134
unaffected

6.1.56
unaffected

6.5.6
unaffected

6.6
unaffected

References

https://git.kernel.org/stable/c/6d5c8862932d31a810b6545f7d69ecc124402c6e

https://git.kernel.org/stable/c/a48d2bcd23f2c98d575bc2f9b7a3fbd16aeea9eb

https://git.kernel.org/stable/c/c61d0b87a7028c2c10faffc524d748334c7b9827

https://git.kernel.org/stable/c/2bff660e0ff349dee84dc4f6f6d10da4497f5b28

https://git.kernel.org/stable/c/29346e217b8ab8a52889b88f00b268278d6b7668

cve.org CVE-2023-52564

nvd.nist.gov CVE-2023-52564

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2023-52564