In the Linux kernel, the following vulnerability has been resolved:
net: nfc: fix races in nfcllcpsockget() and nfcllcpsockget_sn()
Sili Luo reported a race in nfcllcpsock_get(), leading to UAF.
Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock.
nfcllcpsockgetsn() has a similar problem.
Finally nfcllcprecvsnl() needs to make sure the socket found by nfcllcpsockfrom_sn() does not disappear.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52502.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52502.json"
[
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4f2611f07c87b3ddb57c4b9e8efcd1e330fc3dc",
"digest": {
"function_hash": "203576968014832528083966170813026506045",
"length": 878.0
},
"id": "CVE-2023-52502-39b8cda9",
"deprecated": false,
"target": {
"file": "net/nfc/llcp_core.c",
"function": "nfc_llcp_sock_from_sn"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4f2611f07c87b3ddb57c4b9e8efcd1e330fc3dc",
"digest": {
"function_hash": "251955027558697690435844546492661856709",
"length": 530.0
},
"id": "CVE-2023-52502-519bf2ca",
"deprecated": false,
"target": {
"file": "net/nfc/llcp_core.c",
"function": "nfc_llcp_sock_get"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9",
"digest": {
"function_hash": "136709301676625169317392752497365714192",
"length": 989.0
},
"id": "CVE-2023-52502-54633f12",
"deprecated": false,
"target": {
"file": "net/nfc/llcp_core.c",
"function": "nfc_llcp_get_sdp_ssap"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9",
"digest": {
"line_hashes": [
"136927189021842301944665644889065972506",
"110121988983266017603065083491283181102",
"46409678557165324489669682910104693985",
"203726275350142344970217300220372096276",
"256078174018435581878050377905565680082",
"208336864713462545022812073951217916991",
"326535351231319471556932720959406430178",
"263098967218671831707768329110717184016",
"83053209200314760262228408777510899033",
"90538653029151391345217576776965668779",
"305082051438476684386919104042345006394",
"37795260494084969636102154159217693440",
"82363239544817782048238676781631554867",
"247624061862658445815779479198631630334",
"303852042617766289875591788842948288450",
"50909527289000566598649783714829932358",
"204196170636075568213671735626981349637",
"2563562138095477648040437943817463728",
"203726275350142344970217300220372096276",
"172270631240060352153056357781559306041",
"235210601636466319597223293135469122181",
"220973373299426461611739183749283521556",
"252833410877067582198944159689541032976",
"247223173446254799905813631140531309458",
"15750007090753277823175285229839985184",
"332053329599925113365580728143771334667",
"192501603524949799824123895825696376919",
"159170414554920159923675196678045163275",
"83053209200314760262228408777510899033",
"90538653029151391345217576776965668779",
"212028612505733515304490623094541633870",
"223701937698380102596481379936444786951",
"258244949649092306299499526062901350721",
"138745628285406849407830397520792132043",
"327018887157056088167397620376972579863",
"45693946634712388750434720901413551767",
"39687774346707549051477565803942969315",
"248317834000356085643641218309434279627",
"178886495833497507867689324877257207906",
"60997169692171967822450138056779072793",
"190736696692083317235008321036983392223",
"284066389973185910963522083684756681307",
"91811952637888332227997604384238269809"
],
"threshold": 0.9
},
"id": "CVE-2023-52502-56d256a7",
"deprecated": false,
"target": {
"file": "net/nfc/llcp_core.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4f2611f07c87b3ddb57c4b9e8efcd1e330fc3dc",
"digest": {
"function_hash": "317215149609429741260887053030000817789",
"length": 2230.0
},
"id": "CVE-2023-52502-6893715f",
"deprecated": false,
"target": {
"file": "net/nfc/llcp_core.c",
"function": "nfc_llcp_recv_snl"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9",
"digest": {
"function_hash": "203576968014832528083966170813026506045",
"length": 878.0
},
"id": "CVE-2023-52502-696da2d9",
"deprecated": false,
"target": {
"file": "net/nfc/llcp_core.c",
"function": "nfc_llcp_sock_from_sn"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9",
"digest": {
"function_hash": "317215149609429741260887053030000817789",
"length": 2230.0
},
"id": "CVE-2023-52502-87487e3e",
"deprecated": false,
"target": {
"file": "net/nfc/llcp_core.c",
"function": "nfc_llcp_recv_snl"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4f2611f07c87b3ddb57c4b9e8efcd1e330fc3dc",
"digest": {
"line_hashes": [
"136927189021842301944665644889065972506",
"110121988983266017603065083491283181102",
"46409678557165324489669682910104693985",
"203726275350142344970217300220372096276",
"256078174018435581878050377905565680082",
"208336864713462545022812073951217916991",
"326535351231319471556932720959406430178",
"263098967218671831707768329110717184016",
"83053209200314760262228408777510899033",
"90538653029151391345217576776965668779",
"305082051438476684386919104042345006394",
"37795260494084969636102154159217693440",
"82363239544817782048238676781631554867",
"247624061862658445815779479198631630334",
"303852042617766289875591788842948288450",
"50909527289000566598649783714829932358",
"204196170636075568213671735626981349637",
"2563562138095477648040437943817463728",
"203726275350142344970217300220372096276",
"172270631240060352153056357781559306041",
"235210601636466319597223293135469122181",
"220973373299426461611739183749283521556",
"252833410877067582198944159689541032976",
"247223173446254799905813631140531309458",
"15750007090753277823175285229839985184",
"332053329599925113365580728143771334667",
"192501603524949799824123895825696376919",
"159170414554920159923675196678045163275",
"83053209200314760262228408777510899033",
"90538653029151391345217576776965668779",
"212028612505733515304490623094541633870",
"223701937698380102596481379936444786951",
"258244949649092306299499526062901350721",
"138745628285406849407830397520792132043",
"327018887157056088167397620376972579863",
"45693946634712388750434720901413551767",
"39687774346707549051477565803942969315",
"248317834000356085643641218309434279627",
"178886495833497507867689324877257207906",
"60997169692171967822450138056779072793",
"190736696692083317235008321036983392223",
"284066389973185910963522083684756681307",
"91811952637888332227997604384238269809"
],
"threshold": 0.9
},
"id": "CVE-2023-52502-8c4bf05e",
"deprecated": false,
"target": {
"file": "net/nfc/llcp_core.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9",
"digest": {
"function_hash": "149768431017404212784916973920804716069",
"length": 211.0
},
"id": "CVE-2023-52502-9719a1dc",
"deprecated": false,
"target": {
"file": "net/nfc/llcp_core.c",
"function": "nfc_llcp_sock_get_sn"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4f2611f07c87b3ddb57c4b9e8efcd1e330fc3dc",
"digest": {
"function_hash": "294339312768518699709935905436133407635",
"length": 991.0
},
"id": "CVE-2023-52502-ae387818",
"deprecated": false,
"target": {
"file": "net/nfc/llcp_core.c",
"function": "nfc_llcp_get_sdp_ssap"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4f2611f07c87b3ddb57c4b9e8efcd1e330fc3dc",
"digest": {
"function_hash": "149768431017404212784916973920804716069",
"length": 211.0
},
"id": "CVE-2023-52502-e43debda",
"deprecated": false,
"target": {
"file": "net/nfc/llcp_core.c",
"function": "nfc_llcp_sock_get_sn"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9",
"digest": {
"function_hash": "251955027558697690435844546492661856709",
"length": 530.0
},
"id": "CVE-2023-52502-e69ad288",
"deprecated": false,
"target": {
"file": "net/nfc/llcp_core.c",
"function": "nfc_llcp_sock_get"
}
}
]