In the Linux kernel, the following vulnerability has been resolved:
cxl/acpi: Fix a use-after-free in cxlparsecfmws()
KASAN and KFENCE detected an user-after-free in the CXL driver. This happens in the cxldecoderadd() fail path. KASAN prints the following error:
BUG: KASAN: slab-use-after-free in cxlparsecfmws (drivers/cxl/acpi.c:299)
This happens in cxlparsecfmws(), where put_device() is called, releasing cxld, which is accessed later.
Use the local variables in the deverr() instead of pointing to the released memory. Since the deverr() is printing a resource, change the open coded print format to use the %pr format specifier.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53479.json"
}[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"120698868665316790273522268802156100323",
"35496899835627931822791992553216476438",
"103334706423949825005647293897863047332",
"120738386806035630271412119849496800345",
"255872588080819187324532563455674059053"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@748fadc08bcbdaf573b34d9784bb3dbd87441dbf",
"deprecated": false,
"id": "CVE-2023-53479-4ceec96e",
"signature_type": "Line",
"target": {
"file": "drivers/cxl/acpi.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 2094.0,
"function_hash": "84666284625403518193813830234838428558"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@748fadc08bcbdaf573b34d9784bb3dbd87441dbf",
"deprecated": false,
"id": "CVE-2023-53479-867bfd98",
"signature_type": "Function",
"target": {
"function": "cxl_parse_cfmws",
"file": "drivers/cxl/acpi.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"120698868665316790273522268802156100323",
"35496899835627931822791992553216476438",
"103334706423949825005647293897863047332",
"120738386806035630271412119849496800345",
"255872588080819187324532563455674059053"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@316db489647b8ddc381682597e89787eac61a278",
"deprecated": false,
"id": "CVE-2023-53479-9a2b5d8c",
"signature_type": "Line",
"target": {
"file": "drivers/cxl/acpi.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 2637.0,
"function_hash": "297573108531663830760036613433465956839"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4cf67d3cc9994a59cf77bb9c0ccf9007fe916afe",
"deprecated": false,
"id": "CVE-2023-53479-a3ab20b1",
"signature_type": "Function",
"target": {
"function": "cxl_parse_cfmws",
"file": "drivers/cxl/acpi.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"120698868665316790273522268802156100323",
"35496899835627931822791992553216476438",
"103334706423949825005647293897863047332",
"120738386806035630271412119849496800345",
"255872588080819187324532563455674059053"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4cf67d3cc9994a59cf77bb9c0ccf9007fe916afe",
"deprecated": false,
"id": "CVE-2023-53479-cb207636",
"signature_type": "Line",
"target": {
"file": "drivers/cxl/acpi.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 2634.0,
"function_hash": "6883124289378032269995015146049890405"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@316db489647b8ddc381682597e89787eac61a278",
"deprecated": false,
"id": "CVE-2023-53479-fe115889",
"signature_type": "Function",
"target": {
"function": "cxl_parse_cfmws",
"file": "drivers/cxl/acpi.c"
},
"signature_version": "v1"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53479.json"