CVE-2023-52498
Linux Kernel Deadlock in Power Management
Description
In the Linux kernel, the following vulnerability has been resolved: PM: sleep: Fix possible deadlocks in core system-wide PM code It is reported that in low-memory situations the system-wide resume core code deadlocks, because async_schedule_dev() executes its argument function synchronously if it cannot allocate memory (and not only in that case) and that function attempts to acquire a mutex that is already held. Executing the argument function synchronously from within dpm_async_fn() may also be problematic for ordering reasons (it may cause a consumer device's resume callback to be invoked before a requisite supplier device's one, for example). Address this by changing the code in question to use async_schedule_dev_nocall() for scheduling the asynchronous execution of device suspend and resume functions and to directly run them synchronously if async_schedule_dev_nocall() returns false.
INFO
Published Date :
March 11, 2024, 6:15 p.m.
Last Modified :
Dec. 12, 2024, 5:32 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2023-52498.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2023-52498 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2023-52498 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Dec. 12, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NIST CWE-667 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 5.10.210 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.149 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.76 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.15 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.7.3 Changed Reference Type https://git.kernel.org/stable/c/7839d0078e0d5e6cc2fa0b0dfbee71de74f1e557 No Types Assigned https://git.kernel.org/stable/c/7839d0078e0d5e6cc2fa0b0dfbee71de74f1e557 Patch Changed Reference Type https://git.kernel.org/stable/c/7839d0078e0d5e6cc2fa0b0dfbee71de74f1e557 No Types Assigned https://git.kernel.org/stable/c/7839d0078e0d5e6cc2fa0b0dfbee71de74f1e557 Patch Changed Reference Type https://git.kernel.org/stable/c/9bd3dce27b01c51295b60e1433e1dadfb16649f7 No Types Assigned https://git.kernel.org/stable/c/9bd3dce27b01c51295b60e1433e1dadfb16649f7 Patch Changed Reference Type https://git.kernel.org/stable/c/9bd3dce27b01c51295b60e1433e1dadfb16649f7 No Types Assigned https://git.kernel.org/stable/c/9bd3dce27b01c51295b60e1433e1dadfb16649f7 Patch Changed Reference Type https://git.kernel.org/stable/c/a1d62c775b07213c73f81ae842424c74dd14b5f0 No Types Assigned https://git.kernel.org/stable/c/a1d62c775b07213c73f81ae842424c74dd14b5f0 Patch Changed Reference Type https://git.kernel.org/stable/c/a1d62c775b07213c73f81ae842424c74dd14b5f0 No Types Assigned https://git.kernel.org/stable/c/a1d62c775b07213c73f81ae842424c74dd14b5f0 Patch Changed Reference Type https://git.kernel.org/stable/c/e1c9d32c98309ae764893a481552d3f99d46cb34 No Types Assigned https://git.kernel.org/stable/c/e1c9d32c98309ae764893a481552d3f99d46cb34 Patch Changed Reference Type https://git.kernel.org/stable/c/e1c9d32c98309ae764893a481552d3f99d46cb34 No Types Assigned https://git.kernel.org/stable/c/e1c9d32c98309ae764893a481552d3f99d46cb34 Patch Changed Reference Type https://git.kernel.org/stable/c/e681e29d1f59a04ef773296e4bebb17b1b79f8fe No Types Assigned https://git.kernel.org/stable/c/e681e29d1f59a04ef773296e4bebb17b1b79f8fe Patch Changed Reference Type https://git.kernel.org/stable/c/e681e29d1f59a04ef773296e4bebb17b1b79f8fe No Types Assigned https://git.kernel.org/stable/c/e681e29d1f59a04ef773296e4bebb17b1b79f8fe Patch Changed Reference Type https://git.kernel.org/stable/c/f46eb832389f162ad13cb780d0b8cde93641990d No Types Assigned https://git.kernel.org/stable/c/f46eb832389f162ad13cb780d0b8cde93641990d Patch Changed Reference Type https://git.kernel.org/stable/c/f46eb832389f162ad13cb780d0b8cde93641990d No Types Assigned https://git.kernel.org/stable/c/f46eb832389f162ad13cb780d0b8cde93641990d Patch Changed Reference Type https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html No Types Assigned https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Patch -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/7839d0078e0d5e6cc2fa0b0dfbee71de74f1e557 Added Reference https://git.kernel.org/stable/c/9bd3dce27b01c51295b60e1433e1dadfb16649f7 Added Reference https://git.kernel.org/stable/c/a1d62c775b07213c73f81ae842424c74dd14b5f0 Added Reference https://git.kernel.org/stable/c/e1c9d32c98309ae764893a481552d3f99d46cb34 Added Reference https://git.kernel.org/stable/c/e681e29d1f59a04ef773296e4bebb17b1b79f8fe Added Reference https://git.kernel.org/stable/c/f46eb832389f162ad13cb780d0b8cde93641990d Added Reference https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 04, 2024
Action Type Old Value New Value Removed Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2024
Action Type Old Value New Value Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html [No types assigned] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 28, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2024
Action Type Old Value New Value -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Mar. 11, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: PM: sleep: Fix possible deadlocks in core system-wide PM code It is reported that in low-memory situations the system-wide resume core code deadlocks, because async_schedule_dev() executes its argument function synchronously if it cannot allocate memory (and not only in that case) and that function attempts to acquire a mutex that is already held. Executing the argument function synchronously from within dpm_async_fn() may also be problematic for ordering reasons (it may cause a consumer device's resume callback to be invoked before a requisite supplier device's one, for example). Address this by changing the code in question to use async_schedule_dev_nocall() for scheduling the asynchronous execution of device suspend and resume functions and to directly run them synchronously if async_schedule_dev_nocall() returns false. Added Reference Linux https://git.kernel.org/stable/c/f46eb832389f162ad13cb780d0b8cde93641990d [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/a1d62c775b07213c73f81ae842424c74dd14b5f0 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/e1c9d32c98309ae764893a481552d3f99d46cb34 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/e681e29d1f59a04ef773296e4bebb17b1b79f8fe [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/9bd3dce27b01c51295b60e1433e1dadfb16649f7 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/7839d0078e0d5e6cc2fa0b0dfbee71de74f1e557 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2023-52498 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2023-52498
weaknesses.