CVE-2023-53501

To prevent this, the pasid_state object contains a refcount. * set to 1 on pasid bind * incremented on each ppr notification start * decremented on each ppr notification done * decremented on pasid unbind

Since refcountdec assumes that refcount will never reach 0: the current implementation causes the following to be invoked on pasid unbind: REFCOUNTWARN("decrement hit 0; leaking memory")

Fix this issue by changing refcountdec to refcountdecandtest to explicitly handle refcount=1.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53501.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

8bc54824da4e8fcf0ed679cf09ac32f23d83254a

Fixed

a50d60b8f2aff46dd7c7edb4a5835cdc4d432c22

Fixed

13ed255248dfbbb7f23f9170c7a537fb9ca22c73

Fixed

9ccc51be3126b25cfe9351dbffde946c925cc28a

Fixed

98d86bf32187db27946ca817c2467a5f2f7aa02f

Fixed

534103bcd52ca9c1fecbc70e717b4a538dc4ded8

Affected versions

v5.*

v5.14

v5.14-rc4

v5.14-rc5

v5.14-rc6

v5.14-rc7

v5.15

v5.15-rc1

v5.15-rc2

v5.15-rc3

v5.15-rc4

v5.15-rc5

v5.15-rc6

v5.15-rc7

v5.15.1

v5.15.10

v5.15.100

v5.15.101

v5.15.102

v5.15.103

v5.15.104

v5.15.105

v5.15.106

v5.15.107

v5.15.108

v5.15.109

v5.15.11

v5.15.110

v5.15.111

v5.15.112

v5.15.113

v5.15.114

v5.15.115

v5.15.116

v5.15.117

v5.15.118

v5.15.119

v5.15.12

v5.15.120

v5.15.121

v5.15.122

v5.15.123

v5.15.124

v5.15.125

v5.15.126

v5.15.127

v5.15.128

v5.15.129

v5.15.13

v5.15.130

v5.15.131

v5.15.14

v5.15.15

v5.15.16

v5.15.17

v5.15.18

v5.15.19

v5.15.2

v5.15.20

v5.15.21

v5.15.22

v5.15.23

v5.15.24

v5.15.25

v5.15.26

v5.15.27

v5.15.28

v5.15.29

v5.15.3

v5.15.30

v5.15.31

v5.15.32

v5.15.33

v5.15.34

v5.15.35

v5.15.36

v5.15.37

v5.15.38

v5.15.39

v5.15.4

v5.15.40

v5.15.41

v5.15.42

v5.15.43

v5.15.44

v5.15.45

v5.15.46

v5.15.47

v5.15.48

v5.15.49

v5.15.5

v5.15.50

v5.15.51

v5.15.52

v5.15.53

v5.15.54

v5.15.55

v5.15.56

v5.15.57

v5.15.58

v5.15.59

v5.15.6

v5.15.60

v5.15.61

v5.15.62

v5.15.63

v5.15.64

v5.15.65

v5.15.66

v5.15.67

v5.15.68

v5.15.69

v5.15.7

v5.15.70

v5.15.71

v5.15.72

v5.15.73

v5.15.74

v5.15.75

v5.15.76

v5.15.77

v5.15.78

v5.15.79

v5.15.8

v5.15.80

v5.15.81

v5.15.82

v5.15.83

v5.15.84

v5.15.85

v5.15.86

v5.15.87

v5.15.88

v5.15.89

v5.15.9

v5.15.90

v5.15.91

v5.15.92

v5.15.93

v5.15.94

v5.15.95

v5.15.96

v5.15.97

v5.15.98

v5.15.99

v5.16

v5.16-rc1

v5.16-rc2

v5.16-rc3

v5.16-rc4

v5.16-rc5

v5.16-rc6

v5.16-rc7

v5.16-rc8

v5.17

v5.17-rc1

v5.17-rc2

v5.17-rc3

v5.17-rc4

v5.17-rc5

v5.17-rc6

v5.17-rc7

v5.17-rc8

v5.18

v5.18-rc1

v5.18-rc2

v5.18-rc3

v5.18-rc4

v5.18-rc5

v5.18-rc6

v5.18-rc7

v5.19

v5.19-rc1

v5.19-rc2

v5.19-rc3

v5.19-rc4

v5.19-rc5

v5.19-rc6

v5.19-rc7

v5.19-rc8

v6.*

v6.0

v6.0-rc1

v6.0-rc2

v6.0-rc3

v6.0-rc4

v6.0-rc5

v6.0-rc6

v6.0-rc7

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.1.1

v6.1.10

v6.1.11

v6.1.12

v6.1.13

v6.1.14

v6.1.15

v6.1.16

v6.1.17

v6.1.18

v6.1.19

v6.1.2

v6.1.20

v6.1.21

v6.1.22

v6.1.23

v6.1.24

v6.1.25

v6.1.26

v6.1.27

v6.1.28

v6.1.29

v6.1.3

v6.1.30

v6.1.31

v6.1.32

v6.1.33

v6.1.34

v6.1.35

v6.1.36

v6.1.37

v6.1.38

v6.1.39

v6.1.4

v6.1.40

v6.1.41

v6.1.42

v6.1.43

v6.1.44

v6.1.45

v6.1.46

v6.1.47

v6.1.48

v6.1.49

v6.1.5

v6.1.50

v6.1.51

v6.1.52

v6.1.6

v6.1.7

v6.1.8

v6.1.9

v6.2

v6.2-rc1

v6.2-rc2

v6.2-rc3

v6.2-rc4

v6.2-rc5

v6.2-rc6

v6.2-rc7

v6.2-rc8

v6.3

v6.3-rc1

v6.3-rc2

v6.3-rc3

v6.3-rc4

v6.3-rc5

v6.3-rc6

v6.3-rc7

v6.4

v6.4-rc1

v6.4-rc2

v6.4-rc3

v6.4-rc4

v6.4-rc5

v6.4-rc6

v6.4-rc7

v6.4.1

v6.4.10

v6.4.11

v6.4.12

v6.4.13

v6.4.14

v6.4.15

v6.4.2

v6.4.3

v6.4.4

v6.4.5

v6.4.6

v6.4.7

v6.4.8

v6.4.9

v6.5

v6.5-rc1

v6.5-rc2

v6.5-rc3

v6.5-rc4

v6.5-rc5

v6.5-rc6

v6.5-rc7

v6.5.1

v6.5.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53501.json"

vanir_signatures

[
    {
        "id": "CVE-2023-53501-1afd12c1",
        "target": {
            "function": "put_pasid_state_wait",
            "file": "drivers/iommu/amd/iommu_v2.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a50d60b8f2aff46dd7c7edb4a5835cdc4d432c22",
        "digest": {
            "function_hash": "27549943489426976684960040244367961144",
            "length": 157.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53501-340105b5",
        "target": {
            "function": "put_pasid_state_wait",
            "file": "drivers/iommu/amd/iommu_v2.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ccc51be3126b25cfe9351dbffde946c925cc28a",
        "digest": {
            "function_hash": "27549943489426976684960040244367961144",
            "length": 157.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53501-809ca76b",
        "target": {
            "file": "drivers/iommu/amd/iommu_v2.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@534103bcd52ca9c1fecbc70e717b4a538dc4ded8",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "202903671457099793163618007315205797383",
                "138818796410511711022102277580474346071",
                "151314674619640767253672328481311338542",
                "157773198344314086882562294808461803406",
                "309671446595942992889277934794014641588"
            ]
        },
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53501-88f99d32",
        "target": {
            "file": "drivers/iommu/amd/iommu_v2.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a50d60b8f2aff46dd7c7edb4a5835cdc4d432c22",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "202903671457099793163618007315205797383",
                "138818796410511711022102277580474346071",
                "151314674619640767253672328481311338542",
                "157773198344314086882562294808461803406",
                "309671446595942992889277934794014641588"
            ]
        },
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53501-91f9d7c9",
        "target": {
            "function": "put_pasid_state_wait",
            "file": "drivers/iommu/amd/iommu_v2.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@98d86bf32187db27946ca817c2467a5f2f7aa02f",
        "digest": {
            "function_hash": "27549943489426976684960040244367961144",
            "length": 157.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53501-a40b9573",
        "target": {
            "file": "drivers/iommu/amd/iommu_v2.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ccc51be3126b25cfe9351dbffde946c925cc28a",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "202903671457099793163618007315205797383",
                "138818796410511711022102277580474346071",
                "151314674619640767253672328481311338542",
                "157773198344314086882562294808461803406",
                "309671446595942992889277934794014641588"
            ]
        },
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53501-f6e5122b",
        "target": {
            "file": "drivers/iommu/amd/iommu_v2.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@98d86bf32187db27946ca817c2467a5f2f7aa02f",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "202903671457099793163618007315205797383",
                "138818796410511711022102277580474346071",
                "151314674619640767253672328481311338542",
                "157773198344314086882562294808461803406",
                "309671446595942992889277934794014641588"
            ]
        },
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53501-f7587c2b",
        "target": {
            "function": "put_pasid_state_wait",
            "file": "drivers/iommu/amd/iommu_v2.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@534103bcd52ca9c1fecbc70e717b4a538dc4ded8",
        "digest": {
            "function_hash": "27549943489426976684960040244367961144",
            "length": 157.0
        },
        "signature_type": "Function"
    }
]

Git / github.com/gregkh/linux