In the Linux kernel, the following vulnerability has been resolved:
ubi: Fix UAF wear-leveling entry in eraseblkcountseq_show()
Wear-leveling entry could be freed in error path, which may be accessed again in eraseblkcountseq_show(), for example:
_eraseworker eraseblkcountseqshow wl = ubi->lookuptbl[*blocknumber] if (wl) wlentrydestroy ubi->lookuptbl[e->pnum] = NULL kmemcachefree(ubiwlentryslab, e) erasecount = wl->ec // UAF!
Wear-leveling entry updating/accessing in ubi->lookuptbl should be protected by ubi->wllock, fix it by adding ubi->wllock to serialize wl entry accessing between wlentrydestroy() and eraseblkcountseq_show().
Fetch a reproducer in [Link].
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53826.json"
}