CVE-2023-52907

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-52907
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52907.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-52907
Related
Published
2024-08-21T07:15:06Z
Modified
2024-09-18T03:23:00.220040Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

nfc: pn533: Wait for outurb's completion in pn533usbsendframe()

Fix a use-after-free that occurs in hcd when inurb sent from pn533usbsendframe() is completed earlier than outurb. Its callback frees the skb data in pn533sendasynccomplete() that is used as a transfer buffer of outurb. Wait before sending inurb until the callback of outurb is called. To modify the callback of outurb alone, separate the complete function of outurb and ackurb.

Found by a modified version of syzkaller.

BUG: KASAN: use-after-free in dummytimer Call Trace: memcpy (mm/kasan/shadow.c:65) dummyperformtransfer (drivers/usb/gadget/udc/dummyhcd.c:1352) transfer (drivers/usb/gadget/udc/dummyhcd.c:1453) dummytimer (drivers/usb/gadget/udc/dummyhcd.c:1972) archstaticbranch (arch/x86/include/asm/jumplabel.h:27) statickeyfalse (include/linux/jumplabel.h:207) timerexpireexit (include/trace/events/timer.h:127) calltimerfn (kernel/time/timer.c:1475) expiretimers (kernel/time/timer.c:1519) _runtimers (kernel/time/timer.c:1790) runtimersoftirq (kernel/time/timer.c:1803)

References

Affected packages

Debian:11 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.10.178-1

Affected versions

5.*

5.10.46-4
5.10.46-5
5.10.70-1~bpo10+1
5.10.70-1
5.10.84-1
5.10.92-1~bpo10+1
5.10.92-1
5.10.92-2
5.10.103-1~bpo10+1
5.10.103-1
5.10.106-1
5.10.113-1
5.10.120-1~bpo10+1
5.10.120-1
5.10.127-1
5.10.127-2~bpo10+1
5.10.127-2
5.10.136-1
5.10.140-1
5.10.148-1
5.10.149-1
5.10.149-2
5.10.158-1
5.10.158-2
5.10.162-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.7-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.7-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}