In the Linux kernel, the following vulnerability has been resolved:
drm/msm/dp: Free resources after unregistering them
The DP component's unbind operation walks through the submodules to unregister and clean things up. But if the unbind happens because the DP controller itself is being removed, all the memory for those submodules has just been freed.
Change the order of these operations to avoid the many use-after-free that otherwise happens in this code path.
Patchwork: https://patchwork.freedesktop.org/patch/542166/
[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"322849710450982522390705344819387375673",
"140767778245589235186482528800307355742",
"243178162618821028232998665446282129214",
"280773099106035635372285965753891593099",
"286488479524003985126631686976259397792"
]
},
"target": {
"file": "drivers/gpu/drm/msm/dp/dp_display.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca47d0dc00968358c136a1847cfed550cedfd1b5",
"id": "CVE-2023-53316-23a9962a",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "319950149988104862553958402151983746271",
"length": 199.0
},
"target": {
"file": "drivers/gpu/drm/msm/dp/dp_display.c",
"function": "dp_display_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c3278db06e332fdc14f3f297499fb88ded264d2",
"id": "CVE-2023-53316-30885b52",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"322849710450982522390705344819387375673",
"140767778245589235186482528800307355742",
"243178162618821028232998665446282129214",
"280773099106035635372285965753891593099",
"286488479524003985126631686976259397792"
]
},
"target": {
"file": "drivers/gpu/drm/msm/dp/dp_display.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fa0048a4b1fa7a50c8b0e514f5b428abdf69a6f8",
"id": "CVE-2023-53316-39b1e17f",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "319950149988104862553958402151983746271",
"length": 199.0
},
"target": {
"file": "drivers/gpu/drm/msm/dp/dp_display.c",
"function": "dp_display_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e9f1a2367aea7d61f6781213e25313cd983b0d7",
"id": "CVE-2023-53316-6c30599a",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "319950149988104862553958402151983746271",
"length": 199.0
},
"target": {
"file": "drivers/gpu/drm/msm/dp/dp_display.c",
"function": "dp_display_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fa0048a4b1fa7a50c8b0e514f5b428abdf69a6f8",
"id": "CVE-2023-53316-8e60e103",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"322849710450982522390705344819387375673",
"140767778245589235186482528800307355742",
"243178162618821028232998665446282129214",
"280773099106035635372285965753891593099",
"286488479524003985126631686976259397792"
]
},
"target": {
"file": "drivers/gpu/drm/msm/dp/dp_display.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c3278db06e332fdc14f3f297499fb88ded264d2",
"id": "CVE-2023-53316-a41e8db2",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "177493873797668782927094968783934667411",
"length": 228.0
},
"target": {
"file": "drivers/gpu/drm/msm/dp/dp_display.c",
"function": "dp_display_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c3f3d35f5e05c468b048eb42a4f8c62c6655692",
"id": "CVE-2023-53316-a4d3e56c",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"322849710450982522390705344819387375673",
"140767778245589235186482528800307355742",
"243178162618821028232998665446282129214",
"280773099106035635372285965753891593099",
"286488479524003985126631686976259397792"
]
},
"target": {
"file": "drivers/gpu/drm/msm/dp/dp_display.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e9f1a2367aea7d61f6781213e25313cd983b0d7",
"id": "CVE-2023-53316-c1c65c14",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "177493873797668782927094968783934667411",
"length": 228.0
},
"target": {
"file": "drivers/gpu/drm/msm/dp/dp_display.c",
"function": "dp_display_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c67a55f7cc8d767d624235bf1bcd0947e56abe0f",
"id": "CVE-2023-53316-c420a3c0",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"272298368309638910874980924475709400110",
"290509303125079379628895327827976131838",
"188995849421237909603635734319260166010",
"280773099106035635372285965753891593099",
"286488479524003985126631686976259397792"
]
},
"target": {
"file": "drivers/gpu/drm/msm/dp/dp_display.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c67a55f7cc8d767d624235bf1bcd0947e56abe0f",
"id": "CVE-2023-53316-cbab13ba",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "319950149988104862553958402151983746271",
"length": 199.0
},
"target": {
"file": "drivers/gpu/drm/msm/dp/dp_display.c",
"function": "dp_display_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca47d0dc00968358c136a1847cfed550cedfd1b5",
"id": "CVE-2023-53316-d370aeca",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"272298368309638910874980924475709400110",
"290509303125079379628895327827976131838",
"188995849421237909603635734319260166010",
"280773099106035635372285965753891593099",
"286488479524003985126631686976259397792"
]
},
"target": {
"file": "drivers/gpu/drm/msm/dp/dp_display.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c3f3d35f5e05c468b048eb42a4f8c62c6655692",
"id": "CVE-2023-53316-e9e615f7",
"deprecated": false,
"signature_version": "v1"
}
]