In the Linux kernel, the following vulnerability has been resolved:
nfc: pn533: Wait for outurb's completion in pn533usbsendframe()
Fix a use-after-free that occurs in hcd when inurb sent from pn533usbsendframe() is completed earlier than outurb. Its callback frees the skb data in pn533sendasynccomplete() that is used as a transfer buffer of outurb. Wait before sending inurb until the callback of outurb is called. To modify the callback of outurb alone, separate the complete function of outurb and ackurb.
Found by a modified version of syzkaller.
BUG: KASAN: use-after-free in dummytimer Call Trace: memcpy (mm/kasan/shadow.c:65) dummyperformtransfer (drivers/usb/gadget/udc/dummyhcd.c:1352) transfer (drivers/usb/gadget/udc/dummyhcd.c:1453) dummytimer (drivers/usb/gadget/udc/dummyhcd.c:1972) archstaticbranch (arch/x86/include/asm/jumplabel.h:27) statickeyfalse (include/linux/jumplabel.h:207) timerexpireexit (include/trace/events/timer.h:127) calltimerfn (kernel/time/timer.c:1475) expiretimers (kernel/time/timer.c:1519) _runtimers (kernel/time/timer.c:1790) runtimersoftirq (kernel/time/timer.c:1803)
[
{
"id": "CVE-2023-52907-01e4e79a",
"target": {
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"line_hashes": [
"74040911136155828311425452345785334640",
"315997151031021226800307472480754550292",
"328046518435321243356274340423189515128",
"225340237589097674993545958665424919548",
"49832471271315614609848313718228928157",
"119317816853772579272394899769617729350",
"64724837990543337406627216724101771131",
"90393163889100124200061486190622830812",
"165649384663611663598104829865599929654",
"145818348112850414533393024623373556670",
"168247578594932186527250337636447471515",
"285647040618330511543734803392440634465",
"270753379724896500801954483146356603462",
"282405449904366387219876958641203975900",
"204457485626455831415731028832528534436",
"163435017670401307953163886644357737058",
"209094141461180716855026247910825073528",
"280536404038522188044118970793719909182",
"127259173855555172000752063558836312012",
"28962672386402505944938861373783016955",
"73835399511273407908032618130720300396",
"307632007165284355586829711402589015566",
"8512785361189641152960863184002965447",
"30438655051205976217031053793580404995"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35529d6b827eedb6bf7e81130e4b7e0aba9e58d2",
"signature_type": "Line"
},
{
"id": "CVE-2023-52907-0ca9b350",
"target": {
"function": "pn533_usb_send_frame",
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"length": 738.0,
"function_hash": "19648165505810818281943532732477685433"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9dab880d675b9d0dd56c6428e4e8352a3339371d",
"signature_type": "Function"
},
{
"id": "CVE-2023-52907-0f30a778",
"target": {
"function": "pn533_usb_probe",
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"length": 2790.0,
"function_hash": "101142330058152498653559276858412715907"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ca78c99656f5c448567db1e148367aa3b01c80a",
"signature_type": "Function"
},
{
"id": "CVE-2023-52907-1c48a313",
"target": {
"function": "pn533_usb_send_frame",
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"length": 738.0,
"function_hash": "19648165505810818281943532732477685433"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8998db5021a28ad67aa8d627bdb4226e4046ccc4",
"signature_type": "Function"
},
{
"id": "CVE-2023-52907-2397ce52",
"target": {
"function": "pn533_usb_probe",
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"length": 2790.0,
"function_hash": "178450439448598914387900847097761820811"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9dab880d675b9d0dd56c6428e4e8352a3339371d",
"signature_type": "Function"
},
{
"id": "CVE-2023-52907-31c8d2b6",
"target": {
"function": "pn533_usb_probe",
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"length": 2754.0,
"function_hash": "59862361085452249705704572637191416695"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9424d2205fe94a095fb9365ec0c6137f0b394a2b",
"signature_type": "Function"
},
{
"id": "CVE-2023-52907-353668fd",
"target": {
"function": "pn533_usb_send_frame",
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"length": 738.0,
"function_hash": "19648165505810818281943532732477685433"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9424d2205fe94a095fb9365ec0c6137f0b394a2b",
"signature_type": "Function"
},
{
"id": "CVE-2023-52907-36082e44",
"target": {
"function": "pn533_usb_send_frame",
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"length": 738.0,
"function_hash": "19648165505810818281943532732477685433"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39ae73e581112cfe27ba50aecb1c891ce57cecb1",
"signature_type": "Function"
},
{
"id": "CVE-2023-52907-3c7579eb",
"target": {
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"line_hashes": [
"74040911136155828311425452345785334640",
"315997151031021226800307472480754550292",
"328046518435321243356274340423189515128",
"225340237589097674993545958665424919548",
"49832471271315614609848313718228928157",
"119317816853772579272394899769617729350",
"64724837990543337406627216724101771131",
"90393163889100124200061486190622830812",
"165649384663611663598104829865599929654",
"145818348112850414533393024623373556670",
"168247578594932186527250337636447471515",
"285647040618330511543734803392440634465",
"270753379724896500801954483146356603462",
"282405449904366387219876958641203975900",
"204457485626455831415731028832528534436",
"163435017670401307953163886644357737058",
"209094141461180716855026247910825073528",
"280536404038522188044118970793719909182",
"127259173855555172000752063558836312012",
"28962672386402505944938861373783016955",
"73835399511273407908032618130720300396",
"307632007165284355586829711402589015566",
"8512785361189641152960863184002965447",
"30438655051205976217031053793580404995"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9424d2205fe94a095fb9365ec0c6137f0b394a2b",
"signature_type": "Line"
},
{
"id": "CVE-2023-52907-519393fe",
"target": {
"function": "pn533_usb_probe",
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"length": 2790.0,
"function_hash": "178450439448598914387900847097761820811"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39ae73e581112cfe27ba50aecb1c891ce57cecb1",
"signature_type": "Function"
},
{
"id": "CVE-2023-52907-53381e1f",
"target": {
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"line_hashes": [
"74040911136155828311425452345785334640",
"315997151031021226800307472480754550292",
"328046518435321243356274340423189515128",
"225340237589097674993545958665424919548",
"49832471271315614609848313718228928157",
"119317816853772579272394899769617729350",
"64724837990543337406627216724101771131",
"90393163889100124200061486190622830812",
"165649384663611663598104829865599929654",
"145818348112850414533393024623373556670",
"168247578594932186527250337636447471515",
"285647040618330511543734803392440634465",
"270753379724896500801954483146356603462",
"282405449904366387219876958641203975900",
"204457485626455831415731028832528534436",
"163435017670401307953163886644357737058",
"209094141461180716855026247910825073528",
"280536404038522188044118970793719909182",
"127259173855555172000752063558836312012",
"28962672386402505944938861373783016955",
"73835399511273407908032618130720300396",
"307632007165284355586829711402589015566",
"8512785361189641152960863184002965447",
"30438655051205976217031053793580404995"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@321db5131c92983dac4f3338e8fbb6df214238c0",
"signature_type": "Line"
},
{
"id": "CVE-2023-52907-5de16a67",
"target": {
"function": "pn533_usb_probe",
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"length": 2754.0,
"function_hash": "59862361085452249705704572637191416695"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@321db5131c92983dac4f3338e8fbb6df214238c0",
"signature_type": "Function"
},
{
"id": "CVE-2023-52907-70cf9b4d",
"target": {
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"line_hashes": [
"74040911136155828311425452345785334640",
"315997151031021226800307472480754550292",
"328046518435321243356274340423189515128",
"225340237589097674993545958665424919548",
"49832471271315614609848313718228928157",
"119317816853772579272394899769617729350",
"64724837990543337406627216724101771131",
"90393163889100124200061486190622830812",
"165649384663611663598104829865599929654",
"145818348112850414533393024623373556670",
"168247578594932186527250337636447471515",
"285647040618330511543734803392440634465",
"270753379724896500801954483146356603462",
"282405449904366387219876958641203975900",
"204457485626455831415731028832528534436",
"163435017670401307953163886644357737058",
"209094141461180716855026247910825073528",
"280536404038522188044118970793719909182",
"127259173855555172000752063558836312012",
"28962672386402505944938861373783016955",
"73835399511273407908032618130720300396",
"307632007165284355586829711402589015566",
"8512785361189641152960863184002965447",
"30438655051205976217031053793580404995"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ca78c99656f5c448567db1e148367aa3b01c80a",
"signature_type": "Line"
},
{
"id": "CVE-2023-52907-912bb443",
"target": {
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"line_hashes": [
"74040911136155828311425452345785334640",
"315997151031021226800307472480754550292",
"328046518435321243356274340423189515128",
"225340237589097674993545958665424919548",
"49832471271315614609848313718228928157",
"119317816853772579272394899769617729350",
"64724837990543337406627216724101771131",
"90393163889100124200061486190622830812",
"165649384663611663598104829865599929654",
"145818348112850414533393024623373556670",
"168247578594932186527250337636447471515",
"285647040618330511543734803392440634465",
"270753379724896500801954483146356603462",
"282405449904366387219876958641203975900",
"204457485626455831415731028832528534436",
"163435017670401307953163886644357737058",
"209094141461180716855026247910825073528",
"280536404038522188044118970793719909182",
"127259173855555172000752063558836312012",
"28962672386402505944938861373783016955",
"73835399511273407908032618130720300396",
"307632007165284355586829711402589015566",
"8512785361189641152960863184002965447",
"30438655051205976217031053793580404995"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9dab880d675b9d0dd56c6428e4e8352a3339371d",
"signature_type": "Line"
},
{
"id": "CVE-2023-52907-b7e3beec",
"target": {
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"line_hashes": [
"74040911136155828311425452345785334640",
"315997151031021226800307472480754550292",
"328046518435321243356274340423189515128",
"225340237589097674993545958665424919548",
"49832471271315614609848313718228928157",
"119317816853772579272394899769617729350",
"64724837990543337406627216724101771131",
"90393163889100124200061486190622830812",
"165649384663611663598104829865599929654",
"145818348112850414533393024623373556670",
"168247578594932186527250337636447471515",
"285647040618330511543734803392440634465",
"270753379724896500801954483146356603462",
"282405449904366387219876958641203975900",
"204457485626455831415731028832528534436",
"163435017670401307953163886644357737058",
"209094141461180716855026247910825073528",
"280536404038522188044118970793719909182",
"127259173855555172000752063558836312012",
"28962672386402505944938861373783016955",
"73835399511273407908032618130720300396",
"307632007165284355586829711402589015566",
"8512785361189641152960863184002965447",
"30438655051205976217031053793580404995"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39ae73e581112cfe27ba50aecb1c891ce57cecb1",
"signature_type": "Line"
},
{
"id": "CVE-2023-52907-b916cd2c",
"target": {
"function": "pn533_usb_send_frame",
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"length": 738.0,
"function_hash": "19648165505810818281943532732477685433"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@321db5131c92983dac4f3338e8fbb6df214238c0",
"signature_type": "Function"
},
{
"id": "CVE-2023-52907-c79c94b5",
"target": {
"function": "pn533_usb_send_frame",
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"length": 738.0,
"function_hash": "19648165505810818281943532732477685433"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35529d6b827eedb6bf7e81130e4b7e0aba9e58d2",
"signature_type": "Function"
},
{
"id": "CVE-2023-52907-db427cd9",
"target": {
"function": "pn533_usb_probe",
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"length": 2754.0,
"function_hash": "59862361085452249705704572637191416695"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35529d6b827eedb6bf7e81130e4b7e0aba9e58d2",
"signature_type": "Function"
},
{
"id": "CVE-2023-52907-e0b5ce64",
"target": {
"function": "pn533_usb_probe",
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"length": 2790.0,
"function_hash": "178450439448598914387900847097761820811"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8998db5021a28ad67aa8d627bdb4226e4046ccc4",
"signature_type": "Function"
},
{
"id": "CVE-2023-52907-f3e7ce7a",
"target": {
"function": "pn533_usb_send_frame",
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"length": 738.0,
"function_hash": "19648165505810818281943532732477685433"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ca78c99656f5c448567db1e148367aa3b01c80a",
"signature_type": "Function"
},
{
"id": "CVE-2023-52907-f6111d60",
"target": {
"file": "drivers/nfc/pn533/usb.c"
},
"digest": {
"line_hashes": [
"74040911136155828311425452345785334640",
"315997151031021226800307472480754550292",
"328046518435321243356274340423189515128",
"225340237589097674993545958665424919548",
"49832471271315614609848313718228928157",
"119317816853772579272394899769617729350",
"64724837990543337406627216724101771131",
"90393163889100124200061486190622830812",
"165649384663611663598104829865599929654",
"145818348112850414533393024623373556670",
"168247578594932186527250337636447471515",
"285647040618330511543734803392440634465",
"270753379724896500801954483146356603462",
"282405449904366387219876958641203975900",
"204457485626455831415731028832528534436",
"163435017670401307953163886644357737058",
"209094141461180716855026247910825073528",
"280536404038522188044118970793719909182",
"127259173855555172000752063558836312012",
"28962672386402505944938861373783016955",
"73835399511273407908032618130720300396",
"307632007165284355586829711402589015566",
"8512785361189641152960863184002965447",
"30438655051205976217031053793580404995"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8998db5021a28ad67aa8d627bdb4226e4046ccc4",
"signature_type": "Line"
}
]