In the Linux kernel, the following vulnerability has been resolved:
net: nfc: Fix use-after-free in local_cleanup()
Fix a use-after-free that occurs in kfreeskb() called from localcleanup(). This could happen when killing nfc daemon (e.g. neard) after detaching an nfc device. When detaching an nfc device, localcleanup() called from nfcllcpunregisterdevice() frees local->rxpending and decreases local->ref by krefput() in nfcllcplocalput(). In the terminating process, nfc daemon releases all sockets and it leads to decreasing local->ref. After the last release of local->ref, localcleanup() called from localrelease() frees local->rxpending again, which leads to the bug.
Setting local->rxpending to NULL in localcleanup() could prevent use-after-free when local_cleanup() is called twice.
Found by a modified version of syzkaller.
BUG: KASAN: use-after-free in kfree_skb()
Call Trace: dumpstacklvl (lib/dumpstack.c:106) printaddressdescription.constprop.0.cold (mm/kasan/report.c:306) kasancheckrange (mm/kasan/generic.c:189) kfreeskb (net/core/skbuff.c:955) localcleanup (net/nfc/llcpcore.c:159) nfcllcplocalput.part.0 (net/nfc/llcpcore.c:172) nfcllcplocalput (net/nfc/llcpcore.c:181) llcpsockdestruct (net/nfc/llcpsock.c:959) _skdestruct (net/core/sock.c:2133) skdestruct (net/core/sock.c:2181) _skfree (net/core/sock.c:2192) skfree (net/core/sock.c:2203) llcpsockrelease (net/nfc/llcpsock.c:646) _sockrelease (net/socket.c:650) sockclose (net/socket.c:1365) _fput (fs/filetable.c:306) taskworkrun (kernel/taskwork.c:179) ptracenotify (kernel/signal.c:2354) syscallexittousermodeprepare (kernel/entry/common.c:278) syscallexittousermode (kernel/entry/common.c:296) dosyscall64 (arch/x86/entry/common.c:86) entrySYSCALL64afterhwframe (arch/x86/entry/entry_64.S:106)
Allocated by task 4719: kasansavestack (mm/kasan/common.c:45) _kasanslaballoc (mm/kasan/common.c:325) slabpostallochook (mm/slab.h:766) kmemcacheallocnode (mm/slub.c:3497) _allocskb (net/core/skbuff.c:552) pn533recvresponse (drivers/nfc/pn533/usb.c:65) _usbhcdgivebackurb (drivers/usb/core/hcd.c:1671) usbgivebackurbbh (drivers/usb/core/hcd.c:1704) taskletactioncommon.isra.0 (kernel/softirq.c:797) _dosoftirq (kernel/softirq.c:571)
Freed by task 1901: kasansavestack (mm/kasan/common.c:45) kasansettrack (mm/kasan/common.c:52) kasansavefreeinfo (mm/kasan/genericdd.c:518) _kasanslabfree (mm/kasan/common.c:236) kmemcachefree (mm/slub.c:3809) kfreeskbmem (net/core/skbuff.c:874) kfreeskb (net/core/skbuff.c:931) localcleanup (net/nfc/llcpcore.c:159) nfcllcpunregisterdevice (net/nfc/llcpcore.c:1617) nfcunregisterdevice (net/nfc/core.c:1179) pn53xunregisternfc (drivers/nfc/pn533/pn533.c:2846) pn533usbdisconnect (drivers/nfc/pn533/usb.c:579) usbunbindinterface (drivers/usb/core/driver.c:458) devicereleasedriverinternal (drivers/base/dd.c:1279) busremovedevice (drivers/base/bus.c:529) devicedel (drivers/base/core.c:3665) usbdisabledevice (drivers/usb/core/message.c:1420) usbdisconnect (drivers/usb/core.c:2261) hubevent (drivers/usb/core/hub.c:5833) processonework (arch/x86/include/asm/jumplabel.h:27 include/linux/jumplabel.h:212 include/trace/events/workqueue.h:108 kernel/workqueue.c:2281) workerthread (include/linux/list.h:282 kernel/workqueue.c:2423) kthread (kernel/kthread.c:319) retfromfork (arch/x86/entry/entry64.S:301)
[
{
"id": "CVE-2023-53023-006c7b17",
"target": {
"file": "net/nfc/llcp_core.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"299987617945751820274527935231518711946",
"331651818648894109386039448284612782465",
"329308237668199617597188094911825586813",
"245516163014739966433781356657150424082"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad1baab3a5c03692d22ce446f38596a126377f6a",
"signature_type": "Line"
},
{
"id": "CVE-2023-53023-0ea147c7",
"target": {
"function": "local_cleanup",
"file": "net/nfc/llcp_core.c"
},
"signature_version": "v1",
"digest": {
"length": 418.0,
"function_hash": "129697319361630261347245766823569807360"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3605282ec3502ec8847915eb2cf1f340493ff79",
"signature_type": "Function"
},
{
"id": "CVE-2023-53023-3958a924",
"target": {
"file": "net/nfc/llcp_core.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"299987617945751820274527935231518711946",
"331651818648894109386039448284612782465",
"329308237668199617597188094911825586813",
"245516163014739966433781356657150424082"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bb4db7f3187c6e3de6b229ffc87cdb30a2d22b6",
"signature_type": "Line"
},
{
"id": "CVE-2023-53023-6c875b04",
"target": {
"file": "net/nfc/llcp_core.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"299987617945751820274527935231518711946",
"331651818648894109386039448284612782465",
"329308237668199617597188094911825586813",
"245516163014739966433781356657150424082"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54f7be61584b8ec4c6df405f479495b9397bae4a",
"signature_type": "Line"
},
{
"id": "CVE-2023-53023-7acf2e76",
"target": {
"function": "local_cleanup",
"file": "net/nfc/llcp_core.c"
},
"signature_version": "v1",
"digest": {
"length": 418.0,
"function_hash": "129697319361630261347245766823569807360"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f129927feaf7c10b1c38bbce630172e9a08c834",
"signature_type": "Function"
},
{
"id": "CVE-2023-53023-9f6462a2",
"target": {
"function": "local_cleanup",
"file": "net/nfc/llcp_core.c"
},
"signature_version": "v1",
"digest": {
"length": 418.0,
"function_hash": "129697319361630261347245766823569807360"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b09ae26f08aaf2d85f96ea7f90ddd3387f62216f",
"signature_type": "Function"
},
{
"id": "CVE-2023-53023-ac46cda7",
"target": {
"function": "local_cleanup",
"file": "net/nfc/llcp_core.c"
},
"signature_version": "v1",
"digest": {
"length": 418.0,
"function_hash": "129697319361630261347245766823569807360"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bb4db7f3187c6e3de6b229ffc87cdb30a2d22b6",
"signature_type": "Function"
},
{
"id": "CVE-2023-53023-aca43069",
"target": {
"function": "local_cleanup",
"file": "net/nfc/llcp_core.c"
},
"signature_version": "v1",
"digest": {
"length": 418.0,
"function_hash": "129697319361630261347245766823569807360"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a59cdbda3714e11aa3ab579132864c4c8c6d54f9",
"signature_type": "Function"
},
{
"id": "CVE-2023-53023-b0135853",
"target": {
"file": "net/nfc/llcp_core.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"299987617945751820274527935231518711946",
"331651818648894109386039448284612782465",
"329308237668199617597188094911825586813",
"245516163014739966433781356657150424082"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f129927feaf7c10b1c38bbce630172e9a08c834",
"signature_type": "Line"
},
{
"id": "CVE-2023-53023-bef5410f",
"target": {
"file": "net/nfc/llcp_core.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"299987617945751820274527935231518711946",
"331651818648894109386039448284612782465",
"329308237668199617597188094911825586813",
"245516163014739966433781356657150424082"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a59cdbda3714e11aa3ab579132864c4c8c6d54f9",
"signature_type": "Line"
},
{
"id": "CVE-2023-53023-c7de8dae",
"target": {
"file": "net/nfc/llcp_core.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"299987617945751820274527935231518711946",
"331651818648894109386039448284612782465",
"329308237668199617597188094911825586813",
"245516163014739966433781356657150424082"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3605282ec3502ec8847915eb2cf1f340493ff79",
"signature_type": "Line"
},
{
"id": "CVE-2023-53023-c7e70e2c",
"target": {
"function": "local_cleanup",
"file": "net/nfc/llcp_core.c"
},
"signature_version": "v1",
"digest": {
"length": 418.0,
"function_hash": "129697319361630261347245766823569807360"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad1baab3a5c03692d22ce446f38596a126377f6a",
"signature_type": "Function"
},
{
"id": "CVE-2023-53023-f2c6f463",
"target": {
"function": "local_cleanup",
"file": "net/nfc/llcp_core.c"
},
"signature_version": "v1",
"digest": {
"length": 418.0,
"function_hash": "129697319361630261347245766823569807360"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54f7be61584b8ec4c6df405f479495b9397bae4a",
"signature_type": "Function"
},
{
"id": "CVE-2023-53023-fb0d336f",
"target": {
"file": "net/nfc/llcp_core.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"299987617945751820274527935231518711946",
"331651818648894109386039448284612782465",
"329308237668199617597188094911825586813",
"245516163014739966433781356657150424082"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b09ae26f08aaf2d85f96ea7f90ddd3387f62216f",
"signature_type": "Line"
}
]