In the Linux kernel, the following vulnerability has been resolved:
drivers/amd/pm: fix a use-after-free in kvparsepower_table
When ps allocated by kzalloc equals to NULL, kvparsepower_table frees adev->pm.dpm.ps that allocated before. However, after the control flow goes through the following call chains:
kvparsepowertable |-> kvdpminit |-> kvdpmswinit |-> kvdpmfini
The adev->pm.dpm.ps is used in the for loop of kvdpmfini after its first free in kvparsepower_table and causes a use-after-free bug.
{ "vanir_signatures": [ { "id": "CVE-2023-52469-11e944d0", "signature_type": "Function", "target": { "file": "drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c", "function": "kv_parse_power_table" }, "deprecated": false, "digest": { "length": 2382.0, "function_hash": "37110470598018682755583843537349555804" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3426f059eacc33ecc676b0d66539297e1cfafd02" }, { "id": "CVE-2023-52469-1fee497a", "signature_type": "Line", "target": { "file": "drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c" }, "deprecated": false, "digest": { "line_hashes": [ "76247166132604209831182969450492292098", "204528475744014314598655177098745375301", "54008243735318393901927056708429710102", "4518844406556724580719940570630924962", "255399333938970866779294629458578496299", "113365224892704046405914542481746384359", "188742528184198787122919520106708977369" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28dd788382c43b330480f57cd34cde0840896743" }, { "id": "CVE-2023-52469-22a4616e", "signature_type": "Line", "target": { "file": "drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c" }, "deprecated": false, "digest": { "line_hashes": [ "76247166132604209831182969450492292098", "204528475744014314598655177098745375301", "54008243735318393901927056708429710102", "4518844406556724580719940570630924962", "255399333938970866779294629458578496299", "113365224892704046405914542481746384359", "188742528184198787122919520106708977369" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95084632a65d5c0d682a83b55935560bdcd2a1e3" }, { "id": "CVE-2023-52469-29c787c1", "signature_type": "Line", "target": { "file": "drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c" }, "deprecated": false, "digest": { "line_hashes": [ "76247166132604209831182969450492292098", "204528475744014314598655177098745375301", "54008243735318393901927056708429710102", "4518844406556724580719940570630924962", "255399333938970866779294629458578496299", "113365224892704046405914542481746384359", "188742528184198787122919520106708977369" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35fa2394d26e919f63600ce631e6aefc95ec2706" }, { "id": "CVE-2023-52469-301003c4", "signature_type": "Line", "target": { "file": "drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c" }, "deprecated": false, "digest": { "line_hashes": [ "76247166132604209831182969450492292098", "204528475744014314598655177098745375301", "54008243735318393901927056708429710102", "4518844406556724580719940570630924962", "255399333938970866779294629458578496299", "113365224892704046405914542481746384359", "188742528184198787122919520106708977369" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3426f059eacc33ecc676b0d66539297e1cfafd02" }, { "id": "CVE-2023-52469-3f3e2742", "signature_type": "Function", "target": { "file": "drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c", "function": "kv_parse_power_table" }, "deprecated": false, "digest": { "length": 2382.0, "function_hash": "37110470598018682755583843537349555804" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6dcba02ee178282e0d28684d241e0b8462dea6a" }, { "id": "CVE-2023-52469-4abb4e6b", "signature_type": "Function", "target": { "file": "drivers/gpu/drm/amd/amdgpu/kv_dpm.c", "function": "kv_parse_power_table" }, "deprecated": false, "digest": { "length": 2382.0, "function_hash": "37110470598018682755583843537349555804" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b55b06e737feb2a645b0293ea27e38418876d63" }, { "id": "CVE-2023-52469-4d09f123", "signature_type": "Line", "target": { "file": "drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c" }, "deprecated": false, "digest": { "line_hashes": [ "76247166132604209831182969450492292098", "204528475744014314598655177098745375301", "54008243735318393901927056708429710102", "4518844406556724580719940570630924962", "255399333938970866779294629458578496299", "113365224892704046405914542481746384359", "188742528184198787122919520106708977369" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@520e213a0b97b64735a13950e9371e0a5d7a5dc3" }, { "id": "CVE-2023-52469-808d7c86", "signature_type": "Line", "target": { "file": "drivers/gpu/drm/amd/amdgpu/kv_dpm.c" }, "deprecated": false, "digest": { "line_hashes": [ "76247166132604209831182969450492292098", "204528475744014314598655177098745375301", "54008243735318393901927056708429710102", "4518844406556724580719940570630924962", "255399333938970866779294629458578496299", "113365224892704046405914542481746384359", "188742528184198787122919520106708977369" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a27d9d9fc9b5564b8904c3a77a7dea482bfa34e" }, { "id": "CVE-2023-52469-83d5b2c0", "signature_type": "Line", "target": { "file": "drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c" }, "deprecated": false, "digest": { "line_hashes": [ "76247166132604209831182969450492292098", "204528475744014314598655177098745375301", "54008243735318393901927056708429710102", "4518844406556724580719940570630924962", "255399333938970866779294629458578496299", "113365224892704046405914542481746384359", "188742528184198787122919520106708977369" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6dcba02ee178282e0d28684d241e0b8462dea6a" }, { "id": "CVE-2023-52469-91cb7061", "signature_type": "Function", "target": { "file": "drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c", "function": "kv_parse_power_table" }, "deprecated": false, "digest": { "length": 2382.0, "function_hash": "37110470598018682755583843537349555804" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95084632a65d5c0d682a83b55935560bdcd2a1e3" }, { "id": "CVE-2023-52469-a840cd69", "signature_type": "Line", "target": { "file": "drivers/gpu/drm/amd/amdgpu/kv_dpm.c" }, "deprecated": false, "digest": { "line_hashes": [ "76247166132604209831182969450492292098", "204528475744014314598655177098745375301", "54008243735318393901927056708429710102", "4518844406556724580719940570630924962", "255399333938970866779294629458578496299", "113365224892704046405914542481746384359", "188742528184198787122919520106708977369" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b55b06e737feb2a645b0293ea27e38418876d63" }, { "id": "CVE-2023-52469-b03b15e3", "signature_type": "Function", "target": { "file": "drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c", "function": "kv_parse_power_table" }, "deprecated": false, "digest": { "length": 2382.0, "function_hash": "37110470598018682755583843537349555804" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28dd788382c43b330480f57cd34cde0840896743" }, { "id": "CVE-2023-52469-c75259dd", "signature_type": "Function", "target": { "file": "drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c", "function": "kv_parse_power_table" }, "deprecated": false, "digest": { "length": 2382.0, "function_hash": "37110470598018682755583843537349555804" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35fa2394d26e919f63600ce631e6aefc95ec2706" }, { "id": "CVE-2023-52469-c9fee3f9", "signature_type": "Function", "target": { "file": "drivers/gpu/drm/amd/amdgpu/kv_dpm.c", "function": "kv_parse_power_table" }, "deprecated": false, "digest": { "length": 2382.0, "function_hash": "37110470598018682755583843537349555804" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a27d9d9fc9b5564b8904c3a77a7dea482bfa34e" }, { "id": "CVE-2023-52469-e49ff335", "signature_type": "Function", "target": { "file": "drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c", "function": "kv_parse_power_table" }, "deprecated": false, "digest": { "length": 2382.0, "function_hash": "37110470598018682755583843537349555804" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@520e213a0b97b64735a13950e9371e0a5d7a5dc3" } ] }