CVE-2023-52584

The pmif driver data that contains the clocks is allocated along with spmi_controller. On device remove, spmi_controller will be freed first, and then devres , including the clocks, will be cleanup. This leads to UAF because putting the clocks will access the clocks in the pmif driver data, which is already freed along with spmi_controller.

This can be reproduced by enabling DEBUG_TEST_DRIVER_REMOVE and building the kernel with KASAN.

Fix the UAF issue by using unmanaged clk_bulk_get() and putting the clocks before freeing spmi_controller.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52584.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

b45b3ccef8c063d21eb746d85337eaf71f6b5f07

Fixed

521f28eedd6b14228c46e3b81e3bf9b90c2818d8

Fixed

f8dcafcb54632536684336161da8bdd52120f95e

Fixed

9a3881b1f07db1bb55cb0108e6f05cfd027eaf2e

Fixed

e821d50ab5b956ed0effa49faaf29912fd4106d9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52584.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.17.0

Fixed

6.1.77

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.16

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.7.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52584.json"