CVE-2023-52486
Amazon Linux "{"drm" Double Unref " Bug
Description
In the Linux kernel, the following vulnerability has been resolved: drm: Don't unref the same fb many times by mistake due to deadlock handling If we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl() we proceed to unref the fb and then retry the whole thing from the top. But we forget to reset the fb pointer back to NULL, and so if we then get another error during the retry, before the fb lookup, we proceed the unref the same fb again without having gotten another reference. The end result is that the fb will (eventually) end up being freed while it's still in use. Reset fb to NULL once we've unreffed it to avoid doing it again until we've done another fb lookup. This turned out to be pretty easy to hit on a DG2 when doing async flips (and CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y). The first symptom I saw that drm_closefb() simply got stuck in a busy loop while walking the framebuffer list. Fortunately I was able to convince it to oops instead, and from there it was easier to track down the culprit.
INFO
Published Date :
March 11, 2024, 6:15 p.m.
Last Modified :
Jan. 14, 2025, 3:01 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2023-52486.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2023-52486 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2023-52486 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jan. 14, 2025
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NIST CWE-667 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 4.19.307 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.269 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.210 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.149 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.76 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.15 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.7.3 Changed Reference Type https://git.kernel.org/stable/c/376e21a9e4c2c63ee5d8d3aa74be5082c3882229 No Types Assigned https://git.kernel.org/stable/c/376e21a9e4c2c63ee5d8d3aa74be5082c3882229 Patch Changed Reference Type https://git.kernel.org/stable/c/376e21a9e4c2c63ee5d8d3aa74be5082c3882229 No Types Assigned https://git.kernel.org/stable/c/376e21a9e4c2c63ee5d8d3aa74be5082c3882229 Patch Changed Reference Type https://git.kernel.org/stable/c/62f2e79cf9f4f47cc9dea9cebdf58d9f7b5695e0 No Types Assigned https://git.kernel.org/stable/c/62f2e79cf9f4f47cc9dea9cebdf58d9f7b5695e0 Patch Changed Reference Type https://git.kernel.org/stable/c/62f2e79cf9f4f47cc9dea9cebdf58d9f7b5695e0 No Types Assigned https://git.kernel.org/stable/c/62f2e79cf9f4f47cc9dea9cebdf58d9f7b5695e0 Patch Changed Reference Type https://git.kernel.org/stable/c/9dd334a8245011ace45e53298175c7b659edb3e7 No Types Assigned https://git.kernel.org/stable/c/9dd334a8245011ace45e53298175c7b659edb3e7 Patch Changed Reference Type https://git.kernel.org/stable/c/9dd334a8245011ace45e53298175c7b659edb3e7 No Types Assigned https://git.kernel.org/stable/c/9dd334a8245011ace45e53298175c7b659edb3e7 Patch Changed Reference Type https://git.kernel.org/stable/c/b4af63da9d94986c529d74499fdfe44289acd551 No Types Assigned https://git.kernel.org/stable/c/b4af63da9d94986c529d74499fdfe44289acd551 Patch Changed Reference Type https://git.kernel.org/stable/c/b4af63da9d94986c529d74499fdfe44289acd551 No Types Assigned https://git.kernel.org/stable/c/b4af63da9d94986c529d74499fdfe44289acd551 Patch Changed Reference Type https://git.kernel.org/stable/c/bfd0feb1b109cb63b87fdcd00122603787c75a1a No Types Assigned https://git.kernel.org/stable/c/bfd0feb1b109cb63b87fdcd00122603787c75a1a Patch Changed Reference Type https://git.kernel.org/stable/c/bfd0feb1b109cb63b87fdcd00122603787c75a1a No Types Assigned https://git.kernel.org/stable/c/bfd0feb1b109cb63b87fdcd00122603787c75a1a Patch Changed Reference Type https://git.kernel.org/stable/c/cb4daf271302d71a6b9a7c01bd0b6d76febd8f0c No Types Assigned https://git.kernel.org/stable/c/cb4daf271302d71a6b9a7c01bd0b6d76febd8f0c Patch Changed Reference Type https://git.kernel.org/stable/c/cb4daf271302d71a6b9a7c01bd0b6d76febd8f0c No Types Assigned https://git.kernel.org/stable/c/cb4daf271302d71a6b9a7c01bd0b6d76febd8f0c Patch Changed Reference Type https://git.kernel.org/stable/c/d7afdf360f4ac142832b098b4de974e867cc063c No Types Assigned https://git.kernel.org/stable/c/d7afdf360f4ac142832b098b4de974e867cc063c Patch Changed Reference Type https://git.kernel.org/stable/c/d7afdf360f4ac142832b098b4de974e867cc063c No Types Assigned https://git.kernel.org/stable/c/d7afdf360f4ac142832b098b4de974e867cc063c Patch Changed Reference Type https://git.kernel.org/stable/c/f55261469be87c55df13db76dc945f6bcd825105 No Types Assigned https://git.kernel.org/stable/c/f55261469be87c55df13db76dc945f6bcd825105 Patch Changed Reference Type https://git.kernel.org/stable/c/f55261469be87c55df13db76dc945f6bcd825105 No Types Assigned https://git.kernel.org/stable/c/f55261469be87c55df13db76dc945f6bcd825105 Patch Changed Reference Type https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html No Types Assigned https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Mailing List Changed Reference Type https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html No Types Assigned https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html Mailing List -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/376e21a9e4c2c63ee5d8d3aa74be5082c3882229 Added Reference https://git.kernel.org/stable/c/62f2e79cf9f4f47cc9dea9cebdf58d9f7b5695e0 Added Reference https://git.kernel.org/stable/c/9dd334a8245011ace45e53298175c7b659edb3e7 Added Reference https://git.kernel.org/stable/c/b4af63da9d94986c529d74499fdfe44289acd551 Added Reference https://git.kernel.org/stable/c/bfd0feb1b109cb63b87fdcd00122603787c75a1a Added Reference https://git.kernel.org/stable/c/cb4daf271302d71a6b9a7c01bd0b6d76febd8f0c Added Reference https://git.kernel.org/stable/c/d7afdf360f4ac142832b098b4de974e867cc063c Added Reference https://git.kernel.org/stable/c/f55261469be87c55df13db76dc945f6bcd825105 Added Reference https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Added Reference https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 04, 2024
Action Type Old Value New Value Removed Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Removed Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 27, 2024
Action Type Old Value New Value Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html [No types assigned] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2024
Action Type Old Value New Value Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html [No types assigned] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 28, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2024
Action Type Old Value New Value -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Mar. 11, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: drm: Don't unref the same fb many times by mistake due to deadlock handling If we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl() we proceed to unref the fb and then retry the whole thing from the top. But we forget to reset the fb pointer back to NULL, and so if we then get another error during the retry, before the fb lookup, we proceed the unref the same fb again without having gotten another reference. The end result is that the fb will (eventually) end up being freed while it's still in use. Reset fb to NULL once we've unreffed it to avoid doing it again until we've done another fb lookup. This turned out to be pretty easy to hit on a DG2 when doing async flips (and CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y). The first symptom I saw that drm_closefb() simply got stuck in a busy loop while walking the framebuffer list. Fortunately I was able to convince it to oops instead, and from there it was easier to track down the culprit. Added Reference Linux https://git.kernel.org/stable/c/376e21a9e4c2c63ee5d8d3aa74be5082c3882229 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/9dd334a8245011ace45e53298175c7b659edb3e7 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/f55261469be87c55df13db76dc945f6bcd825105 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/b4af63da9d94986c529d74499fdfe44289acd551 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/62f2e79cf9f4f47cc9dea9cebdf58d9f7b5695e0 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/d7afdf360f4ac142832b098b4de974e867cc063c [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/bfd0feb1b109cb63b87fdcd00122603787c75a1a [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/cb4daf271302d71a6b9a7c01bd0b6d76febd8f0c [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2023-52486 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2023-52486
weaknesses.