In the Linux kernel, the following vulnerability has been resolved:
media: netupunidvb: fix use-after-free at deltimer()
When Universal DVB card is detaching, netupunidvbdmafini() uses deltimer() to stop dma->timeout timer. But when timer handler netupunidvbdmatimeout() is running, deltimer() could not stop it. As a result, the use-after-free bug could happen. The process is shown below:
(cleanup routine) | (timer routine)
| mod_timer(&dev->tx_sim_timer, ..)
netupunidvbfinidev() | (wait a time) netupunidvbdmafini() | netupunidvbdmatimeout() deltimer(&dma->timeout); | | ndev->pcidev->dev //USE
Fix by changing deltimer() to deltimer_sync().
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53219.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53219.json"
[
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90229e9ee957d4514425e4a4d82c50ab5d57ac4d",
"digest": {
"line_hashes": [
"164386876774126391843118730814789783238",
"125868189365863306479978565622414803055",
"24470265053955299672394985412171037439",
"189568993064689086965185238900092172298"
],
"threshold": 0.9
},
"id": "CVE-2023-53219-1a681373",
"deprecated": false,
"target": {
"file": "drivers/media/pci/netup_unidvb/netup_unidvb_core.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1550bcf2983ae1220cc8ab899a39a423fa7cb523",
"digest": {
"line_hashes": [
"164386876774126391843118730814789783238",
"125868189365863306479978565622414803055",
"24470265053955299672394985412171037439",
"189568993064689086965185238900092172298"
],
"threshold": 0.9
},
"id": "CVE-2023-53219-5a8a0e64",
"deprecated": false,
"target": {
"file": "drivers/media/pci/netup_unidvb/netup_unidvb_core.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f5bb36bf9b39a2a96e730bf4455095b50713f63",
"digest": {
"line_hashes": [
"164386876774126391843118730814789783238",
"125868189365863306479978565622414803055",
"24470265053955299672394985412171037439",
"189568993064689086965185238900092172298"
],
"threshold": 0.9
},
"id": "CVE-2023-53219-c05b1d4c",
"deprecated": false,
"target": {
"file": "drivers/media/pci/netup_unidvb/netup_unidvb_core.c"
}
}
]