In the Linux kernel, the following vulnerability has been resolved:
media: netupunidvb: fix use-after-free at deltimer()
When Universal DVB card is detaching, netupunidvbdmafini() uses deltimer() to stop dma->timeout timer. But when timer handler netupunidvbdmatimeout() is running, deltimer() could not stop it. As a result, the use-after-free bug could happen. The process is shown below:
(cleanup routine) | (timer routine)
| mod_timer(&dev->tx_sim_timer, ..)
netupunidvbfinidev() | (wait a time) netupunidvbdmafini() | netupunidvbdmatimeout() deltimer(&dma->timeout); | | ndev->pcidev->dev //USE
Fix by changing deltimer() to deltimer_sync().
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@051af3f0b7d1cd8ab7f3e2523ad8ae1af44caba3",
"id": "CVE-2023-53219-01093c2d",
"signature_version": "v1",
"target": {
"file": "drivers/media/pci/netup_unidvb/netup_unidvb_core.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164386876774126391843118730814789783238",
"125868189365863306479978565622414803055",
"24470265053955299672394985412171037439",
"189568993064689086965185238900092172298"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90229e9ee957d4514425e4a4d82c50ab5d57ac4d",
"id": "CVE-2023-53219-1a681373",
"signature_version": "v1",
"target": {
"file": "drivers/media/pci/netup_unidvb/netup_unidvb_core.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164386876774126391843118730814789783238",
"125868189365863306479978565622414803055",
"24470265053955299672394985412171037439",
"189568993064689086965185238900092172298"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c8f9c05e1ebcc9c7bc211cc8b74d8fb86a8756fc",
"id": "CVE-2023-53219-41d65df0",
"signature_version": "v1",
"target": {
"file": "drivers/media/pci/netup_unidvb/netup_unidvb_core.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164386876774126391843118730814789783238",
"125868189365863306479978565622414803055",
"24470265053955299672394985412171037439",
"189568993064689086965185238900092172298"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1550bcf2983ae1220cc8ab899a39a423fa7cb523",
"id": "CVE-2023-53219-5a8a0e64",
"signature_version": "v1",
"target": {
"file": "drivers/media/pci/netup_unidvb/netup_unidvb_core.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164386876774126391843118730814789783238",
"125868189365863306479978565622414803055",
"24470265053955299672394985412171037439",
"189568993064689086965185238900092172298"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07821524f67bf920342bc84ae8b3dea2a315a89e",
"id": "CVE-2023-53219-60454224",
"signature_version": "v1",
"target": {
"file": "drivers/media/pci/netup_unidvb/netup_unidvb_core.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164386876774126391843118730814789783238",
"125868189365863306479978565622414803055",
"24470265053955299672394985412171037439",
"189568993064689086965185238900092172298"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f5bb36bf9b39a2a96e730bf4455095b50713f63",
"id": "CVE-2023-53219-c05b1d4c",
"signature_version": "v1",
"target": {
"file": "drivers/media/pci/netup_unidvb/netup_unidvb_core.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164386876774126391843118730814789783238",
"125868189365863306479978565622414803055",
"24470265053955299672394985412171037439",
"189568993064689086965185238900092172298"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9982db735a8495eee14267cf193c806b957e942",
"id": "CVE-2023-53219-c7f3d055",
"signature_version": "v1",
"target": {
"file": "drivers/media/pci/netup_unidvb/netup_unidvb_core.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164386876774126391843118730814789783238",
"125868189365863306479978565622414803055",
"24470265053955299672394985412171037439",
"189568993064689086965185238900092172298"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd5c77814f290b353917df329f36de1472d47154",
"id": "CVE-2023-53219-e7d02e07",
"signature_version": "v1",
"target": {
"file": "drivers/media/pci/netup_unidvb/netup_unidvb_core.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164386876774126391843118730814789783238",
"125868189365863306479978565622414803055",
"24470265053955299672394985412171037439",
"189568993064689086965185238900092172298"
]
}
}
]