In the Linux kernel, the following vulnerability has been resolved:
platform/x86: wmi: Fix opening of char device
Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp->privatedata, which means that privatedata will not be NULL when wmicharopen() is called. This might cause memory corruption should wmicharopen() be unable to find its driver, something which can happen when the associated WMI device is deleted in wmifreedevices().
Fix the problem by using the miscdevice pointer to retrieve the WMI device data associated with a char device using containerof(). This also avoids wmichar_open() picking a wrong WMI device bound to a driver with the same name as the original driver.
[
{
"signature_type": "Function",
"digest": {
"function_hash": "332255511684720626672813808572956234059",
"length": 452.0
},
"target": {
"file": "drivers/platform/x86/wmi.c",
"function": "wmi_char_open"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eba9ac7abab91c8f6d351460239108bef5e7a0b6",
"id": "CVE-2023-52864-32e84642",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"38084648329187984183985367705750811684",
"337898243139096629859617645838184460757",
"321343162148972936276216552413567851276",
"133120764253449387952576280682991808346",
"211278656404351711684504561916677170723",
"226127749379990907773884793271444536158",
"9393538744374721139856495028433046964",
"109570570591986287403108317286607891505",
"316584114317828248523155902150013083600",
"81406219561676237020184315183653322385",
"110865365265883521070797268263388635120",
"191942399689302935684142519751385207361",
"170974834151354640974681118241403303678",
"287507661255519519158236416199752795432",
"62640328005246447944864469586323684781",
"290440999218984197932632516358618035928"
]
},
"target": {
"file": "drivers/platform/x86/wmi.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eba9ac7abab91c8f6d351460239108bef5e7a0b6",
"id": "CVE-2023-52864-34e54784",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"38084648329187984183985367705750811684",
"337898243139096629859617645838184460757",
"321343162148972936276216552413567851276",
"133120764253449387952576280682991808346",
"211278656404351711684504561916677170723",
"226127749379990907773884793271444536158",
"9393538744374721139856495028433046964",
"109570570591986287403108317286607891505",
"316584114317828248523155902150013083600",
"81406219561676237020184315183653322385",
"110865365265883521070797268263388635120",
"191942399689302935684142519751385207361",
"170974834151354640974681118241403303678",
"287507661255519519158236416199752795432",
"62640328005246447944864469586323684781",
"290440999218984197932632516358618035928"
]
},
"target": {
"file": "drivers/platform/x86/wmi.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf098e937dd125c0317a0d6f261ac2a950a233d6",
"id": "CVE-2023-52864-35d0e9d6",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"38084648329187984183985367705750811684",
"337898243139096629859617645838184460757",
"321343162148972936276216552413567851276",
"133120764253449387952576280682991808346",
"211278656404351711684504561916677170723",
"226127749379990907773884793271444536158",
"9393538744374721139856495028433046964",
"109570570591986287403108317286607891505",
"316584114317828248523155902150013083600",
"81406219561676237020184315183653322385",
"110865365265883521070797268263388635120",
"191942399689302935684142519751385207361",
"170974834151354640974681118241403303678",
"287507661255519519158236416199752795432",
"62640328005246447944864469586323684781",
"290440999218984197932632516358618035928"
]
},
"target": {
"file": "drivers/platform/x86/wmi.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d426a2955e45a95b2282764105fcfb110a540453",
"id": "CVE-2023-52864-3b1bed9b",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"38084648329187984183985367705750811684",
"337898243139096629859617645838184460757",
"321343162148972936276216552413567851276",
"133120764253449387952576280682991808346",
"211278656404351711684504561916677170723",
"226127749379990907773884793271444536158",
"9393538744374721139856495028433046964",
"109570570591986287403108317286607891505",
"316584114317828248523155902150013083600",
"81406219561676237020184315183653322385",
"110865365265883521070797268263388635120",
"191942399689302935684142519751385207361",
"170974834151354640974681118241403303678",
"287507661255519519158236416199752795432",
"62640328005246447944864469586323684781",
"290440999218984197932632516358618035928"
]
},
"target": {
"file": "drivers/platform/x86/wmi.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44a96796d25809502c75771d40ee693c2e44724e",
"id": "CVE-2023-52864-49ce9166",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "332255511684720626672813808572956234059",
"length": 452.0
},
"target": {
"file": "drivers/platform/x86/wmi.c",
"function": "wmi_char_open"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf098e937dd125c0317a0d6f261ac2a950a233d6",
"id": "CVE-2023-52864-6486e9b8",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"38084648329187984183985367705750811684",
"337898243139096629859617645838184460757",
"321343162148972936276216552413567851276",
"133120764253449387952576280682991808346",
"211278656404351711684504561916677170723",
"226127749379990907773884793271444536158",
"9393538744374721139856495028433046964",
"109570570591986287403108317286607891505",
"316584114317828248523155902150013083600",
"81406219561676237020184315183653322385",
"110865365265883521070797268263388635120",
"191942399689302935684142519751385207361",
"170974834151354640974681118241403303678",
"287507661255519519158236416199752795432",
"62640328005246447944864469586323684781",
"290440999218984197932632516358618035928"
]
},
"target": {
"file": "drivers/platform/x86/wmi.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb7b06b59c6887659c6ed0ecd3110835eecbb6a3",
"id": "CVE-2023-52864-835a0dd7",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "332255511684720626672813808572956234059",
"length": 452.0
},
"target": {
"file": "drivers/platform/x86/wmi.c",
"function": "wmi_char_open"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36d85fa7ae0d6be651c1a745191fa7ef055db43e",
"id": "CVE-2023-52864-861e7e64",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "332255511684720626672813808572956234059",
"length": 452.0
},
"target": {
"file": "drivers/platform/x86/wmi.c",
"function": "wmi_char_open"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9fb0eed09e1470cd4021ff52b2b9dfcbcee4c203",
"id": "CVE-2023-52864-97206dde",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "332255511684720626672813808572956234059",
"length": 452.0
},
"target": {
"file": "drivers/platform/x86/wmi.c",
"function": "wmi_char_open"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44a96796d25809502c75771d40ee693c2e44724e",
"id": "CVE-2023-52864-99635a8b",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"38084648329187984183985367705750811684",
"337898243139096629859617645838184460757",
"321343162148972936276216552413567851276",
"133120764253449387952576280682991808346",
"211278656404351711684504561916677170723",
"226127749379990907773884793271444536158",
"9393538744374721139856495028433046964",
"109570570591986287403108317286607891505",
"316584114317828248523155902150013083600",
"81406219561676237020184315183653322385",
"110865365265883521070797268263388635120",
"191942399689302935684142519751385207361",
"170974834151354640974681118241403303678",
"287507661255519519158236416199752795432",
"62640328005246447944864469586323684781",
"290440999218984197932632516358618035928"
]
},
"target": {
"file": "drivers/platform/x86/wmi.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0bf076b734a2fab92d8fddc2b8b03462eee7097",
"id": "CVE-2023-52864-9aa8692f",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "332255511684720626672813808572956234059",
"length": 452.0
},
"target": {
"file": "drivers/platform/x86/wmi.c",
"function": "wmi_char_open"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d426a2955e45a95b2282764105fcfb110a540453",
"id": "CVE-2023-52864-a3e57808",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"38084648329187984183985367705750811684",
"337898243139096629859617645838184460757",
"321343162148972936276216552413567851276",
"133120764253449387952576280682991808346",
"211278656404351711684504561916677170723",
"226127749379990907773884793271444536158",
"9393538744374721139856495028433046964",
"109570570591986287403108317286607891505",
"316584114317828248523155902150013083600",
"81406219561676237020184315183653322385",
"110865365265883521070797268263388635120",
"191942399689302935684142519751385207361",
"170974834151354640974681118241403303678",
"287507661255519519158236416199752795432",
"62640328005246447944864469586323684781",
"290440999218984197932632516358618035928"
]
},
"target": {
"file": "drivers/platform/x86/wmi.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9fb0eed09e1470cd4021ff52b2b9dfcbcee4c203",
"id": "CVE-2023-52864-da042101",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "332255511684720626672813808572956234059",
"length": 452.0
},
"target": {
"file": "drivers/platform/x86/wmi.c",
"function": "wmi_char_open"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb7b06b59c6887659c6ed0ecd3110835eecbb6a3",
"id": "CVE-2023-52864-dee93db7",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "332255511684720626672813808572956234059",
"length": 452.0
},
"target": {
"file": "drivers/platform/x86/wmi.c",
"function": "wmi_char_open"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0bf076b734a2fab92d8fddc2b8b03462eee7097",
"id": "CVE-2023-52864-e490fe59",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"38084648329187984183985367705750811684",
"337898243139096629859617645838184460757",
"321343162148972936276216552413567851276",
"133120764253449387952576280682991808346",
"211278656404351711684504561916677170723",
"226127749379990907773884793271444536158",
"9393538744374721139856495028433046964",
"109570570591986287403108317286607891505",
"316584114317828248523155902150013083600",
"81406219561676237020184315183653322385",
"110865365265883521070797268263388635120",
"191942399689302935684142519751385207361",
"170974834151354640974681118241403303678",
"287507661255519519158236416199752795432",
"62640328005246447944864469586323684781",
"290440999218984197932632516358618035928"
]
},
"target": {
"file": "drivers/platform/x86/wmi.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36d85fa7ae0d6be651c1a745191fa7ef055db43e",
"id": "CVE-2023-52864-f9a51530",
"deprecated": false,
"signature_version": "v1"
}
]