In the Linux kernel, the following vulnerability has been resolved:
platform/x86: wmi: Fix opening of char device
Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp->privatedata, which means that privatedata will not be NULL when wmicharopen() is called. This might cause memory corruption should wmicharopen() be unable to find its driver, something which can happen when the associated WMI device is deleted in wmifreedevices().
Fix the problem by using the miscdevice pointer to retrieve the WMI device data associated with a char device using containerof(). This also avoids wmichar_open() picking a wrong WMI device bound to a driver with the same name as the original driver.
{ "vanir_signatures": [ { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/platform/x86/wmi.c", "function": "wmi_char_open" }, "deprecated": false, "digest": { "length": 452.0, "function_hash": "332255511684720626672813808572956234059" }, "id": "CVE-2023-52864-32e84642", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eba9ac7abab91c8f6d351460239108bef5e7a0b6" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/platform/x86/wmi.c" }, "deprecated": false, "digest": { "line_hashes": [ "38084648329187984183985367705750811684", "337898243139096629859617645838184460757", "321343162148972936276216552413567851276", "133120764253449387952576280682991808346", "211278656404351711684504561916677170723", "226127749379990907773884793271444536158", "9393538744374721139856495028433046964", "109570570591986287403108317286607891505", "316584114317828248523155902150013083600", "81406219561676237020184315183653322385", "110865365265883521070797268263388635120", "191942399689302935684142519751385207361", "170974834151354640974681118241403303678", "287507661255519519158236416199752795432", "62640328005246447944864469586323684781", "290440999218984197932632516358618035928" ], "threshold": 0.9 }, "id": "CVE-2023-52864-34e54784", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eba9ac7abab91c8f6d351460239108bef5e7a0b6" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/platform/x86/wmi.c" }, "deprecated": false, "digest": { "line_hashes": [ "38084648329187984183985367705750811684", "337898243139096629859617645838184460757", "321343162148972936276216552413567851276", "133120764253449387952576280682991808346", "211278656404351711684504561916677170723", "226127749379990907773884793271444536158", "9393538744374721139856495028433046964", "109570570591986287403108317286607891505", "316584114317828248523155902150013083600", "81406219561676237020184315183653322385", "110865365265883521070797268263388635120", "191942399689302935684142519751385207361", "170974834151354640974681118241403303678", "287507661255519519158236416199752795432", "62640328005246447944864469586323684781", "290440999218984197932632516358618035928" ], "threshold": 0.9 }, "id": "CVE-2023-52864-35d0e9d6", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf098e937dd125c0317a0d6f261ac2a950a233d6" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/platform/x86/wmi.c" }, "deprecated": false, "digest": { "line_hashes": [ "38084648329187984183985367705750811684", "337898243139096629859617645838184460757", "321343162148972936276216552413567851276", "133120764253449387952576280682991808346", "211278656404351711684504561916677170723", "226127749379990907773884793271444536158", "9393538744374721139856495028433046964", "109570570591986287403108317286607891505", "316584114317828248523155902150013083600", "81406219561676237020184315183653322385", "110865365265883521070797268263388635120", "191942399689302935684142519751385207361", "170974834151354640974681118241403303678", "287507661255519519158236416199752795432", "62640328005246447944864469586323684781", "290440999218984197932632516358618035928" ], "threshold": 0.9 }, "id": "CVE-2023-52864-3b1bed9b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d426a2955e45a95b2282764105fcfb110a540453" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/platform/x86/wmi.c" }, "deprecated": false, "digest": { "line_hashes": [ "38084648329187984183985367705750811684", "337898243139096629859617645838184460757", "321343162148972936276216552413567851276", "133120764253449387952576280682991808346", "211278656404351711684504561916677170723", "226127749379990907773884793271444536158", "9393538744374721139856495028433046964", "109570570591986287403108317286607891505", "316584114317828248523155902150013083600", "81406219561676237020184315183653322385", "110865365265883521070797268263388635120", "191942399689302935684142519751385207361", "170974834151354640974681118241403303678", "287507661255519519158236416199752795432", "62640328005246447944864469586323684781", "290440999218984197932632516358618035928" ], "threshold": 0.9 }, "id": "CVE-2023-52864-49ce9166", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44a96796d25809502c75771d40ee693c2e44724e" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/platform/x86/wmi.c", "function": "wmi_char_open" }, "deprecated": false, "digest": { "length": 452.0, "function_hash": "332255511684720626672813808572956234059" }, "id": "CVE-2023-52864-6486e9b8", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf098e937dd125c0317a0d6f261ac2a950a233d6" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/platform/x86/wmi.c", "function": "wmi_char_open" }, "deprecated": false, "digest": { "length": 452.0, "function_hash": "332255511684720626672813808572956234059" }, "id": "CVE-2023-52864-861e7e64", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36d85fa7ae0d6be651c1a745191fa7ef055db43e" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/platform/x86/wmi.c", "function": "wmi_char_open" }, "deprecated": false, "digest": { "length": 452.0, "function_hash": "332255511684720626672813808572956234059" }, "id": "CVE-2023-52864-97206dde", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9fb0eed09e1470cd4021ff52b2b9dfcbcee4c203" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/platform/x86/wmi.c", "function": "wmi_char_open" }, "deprecated": false, "digest": { "length": 452.0, "function_hash": "332255511684720626672813808572956234059" }, "id": "CVE-2023-52864-99635a8b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44a96796d25809502c75771d40ee693c2e44724e" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/platform/x86/wmi.c" }, "deprecated": false, "digest": { "line_hashes": [ "38084648329187984183985367705750811684", "337898243139096629859617645838184460757", "321343162148972936276216552413567851276", "133120764253449387952576280682991808346", "211278656404351711684504561916677170723", "226127749379990907773884793271444536158", "9393538744374721139856495028433046964", "109570570591986287403108317286607891505", "316584114317828248523155902150013083600", "81406219561676237020184315183653322385", "110865365265883521070797268263388635120", "191942399689302935684142519751385207361", "170974834151354640974681118241403303678", "287507661255519519158236416199752795432", "62640328005246447944864469586323684781", "290440999218984197932632516358618035928" ], "threshold": 0.9 }, "id": "CVE-2023-52864-9aa8692f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0bf076b734a2fab92d8fddc2b8b03462eee7097" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/platform/x86/wmi.c", "function": "wmi_char_open" }, "deprecated": false, "digest": { "length": 452.0, "function_hash": "332255511684720626672813808572956234059" }, "id": "CVE-2023-52864-a3e57808", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d426a2955e45a95b2282764105fcfb110a540453" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/platform/x86/wmi.c" }, "deprecated": false, "digest": { "line_hashes": [ "38084648329187984183985367705750811684", "337898243139096629859617645838184460757", "321343162148972936276216552413567851276", "133120764253449387952576280682991808346", "211278656404351711684504561916677170723", "226127749379990907773884793271444536158", "9393538744374721139856495028433046964", "109570570591986287403108317286607891505", "316584114317828248523155902150013083600", "81406219561676237020184315183653322385", "110865365265883521070797268263388635120", "191942399689302935684142519751385207361", "170974834151354640974681118241403303678", "287507661255519519158236416199752795432", "62640328005246447944864469586323684781", "290440999218984197932632516358618035928" ], "threshold": 0.9 }, "id": "CVE-2023-52864-da042101", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9fb0eed09e1470cd4021ff52b2b9dfcbcee4c203" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/platform/x86/wmi.c", "function": "wmi_char_open" }, "deprecated": false, "digest": { "length": 452.0, "function_hash": "332255511684720626672813808572956234059" }, "id": "CVE-2023-52864-e490fe59", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0bf076b734a2fab92d8fddc2b8b03462eee7097" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/platform/x86/wmi.c" }, "deprecated": false, "digest": { "line_hashes": [ "38084648329187984183985367705750811684", "337898243139096629859617645838184460757", "321343162148972936276216552413567851276", "133120764253449387952576280682991808346", "211278656404351711684504561916677170723", "226127749379990907773884793271444536158", "9393538744374721139856495028433046964", "109570570591986287403108317286607891505", "316584114317828248523155902150013083600", "81406219561676237020184315183653322385", "110865365265883521070797268263388635120", "191942399689302935684142519751385207361", "170974834151354640974681118241403303678", "287507661255519519158236416199752795432", "62640328005246447944864469586323684781", "290440999218984197932632516358618035928" ], "threshold": 0.9 }, "id": "CVE-2023-52864-f9a51530", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36d85fa7ae0d6be651c1a745191fa7ef055db43e" } ] }