CVE-2023-52564
Linux Kernel - n_gsm Uninitialized Freed Pointer (Use After Free)
Description
In the Linux kernel, the following vulnerability has been resolved: Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux" This reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239. The commit above is reverted as it did not solve the original issue. gsm_cleanup_mux() tries to free up the virtual ttys by calling gsm_dlci_release() for each available DLCI. There, dlci_put() is called to decrease the reference counter for the DLCI via tty_port_put() which finally calls gsm_dlci_free(). This already clears the pointer which is being checked in gsm_cleanup_mux() before calling gsm_dlci_release(). Therefore, it is not necessary to clear this pointer in gsm_cleanup_mux() as done in the reverted commit. The commit introduces a null pointer dereference: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x156/0x420 ? search_exception_tables+0x37/0x50 ? fixup_exception+0x21/0x310 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x26/0x30 ? tty_port_put+0x19/0xa0 gsmtty_cleanup+0x29/0x80 [n_gsm] release_one_tty+0x37/0xe0 process_one_work+0x1e6/0x3e0 worker_thread+0x4c/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe1/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> The actual issue is that nothing guards dlci_put() from being called multiple times while the tty driver was triggered but did not yet finished calling gsm_dlci_free().
INFO
Published Date :
March 2, 2024, 10:15 p.m.
Last Modified :
Jan. 7, 2025, 5:34 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2023-52564.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2023-52564 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2023-52564 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jan. 07, 2025
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NIST CWE-476 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.10.190 up to (excluding) 5.10.198 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.124 up to (excluding) 5.15.134 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.43 up to (excluding) 6.1.56 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.5 up to (excluding) 6.5.6 *cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.6:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.6:rc3:*:*:*:*:*:* Changed Reference Type https://git.kernel.org/stable/c/29346e217b8ab8a52889b88f00b268278d6b7668 No Types Assigned https://git.kernel.org/stable/c/29346e217b8ab8a52889b88f00b268278d6b7668 Patch Changed Reference Type https://git.kernel.org/stable/c/29346e217b8ab8a52889b88f00b268278d6b7668 No Types Assigned https://git.kernel.org/stable/c/29346e217b8ab8a52889b88f00b268278d6b7668 Patch Changed Reference Type https://git.kernel.org/stable/c/2bff660e0ff349dee84dc4f6f6d10da4497f5b28 No Types Assigned https://git.kernel.org/stable/c/2bff660e0ff349dee84dc4f6f6d10da4497f5b28 Patch Changed Reference Type https://git.kernel.org/stable/c/2bff660e0ff349dee84dc4f6f6d10da4497f5b28 No Types Assigned https://git.kernel.org/stable/c/2bff660e0ff349dee84dc4f6f6d10da4497f5b28 Patch Changed Reference Type https://git.kernel.org/stable/c/6d5c8862932d31a810b6545f7d69ecc124402c6e No Types Assigned https://git.kernel.org/stable/c/6d5c8862932d31a810b6545f7d69ecc124402c6e Patch Changed Reference Type https://git.kernel.org/stable/c/6d5c8862932d31a810b6545f7d69ecc124402c6e No Types Assigned https://git.kernel.org/stable/c/6d5c8862932d31a810b6545f7d69ecc124402c6e Patch Changed Reference Type https://git.kernel.org/stable/c/a48d2bcd23f2c98d575bc2f9b7a3fbd16aeea9eb No Types Assigned https://git.kernel.org/stable/c/a48d2bcd23f2c98d575bc2f9b7a3fbd16aeea9eb Patch Changed Reference Type https://git.kernel.org/stable/c/a48d2bcd23f2c98d575bc2f9b7a3fbd16aeea9eb No Types Assigned https://git.kernel.org/stable/c/a48d2bcd23f2c98d575bc2f9b7a3fbd16aeea9eb Patch Changed Reference Type https://git.kernel.org/stable/c/c61d0b87a7028c2c10faffc524d748334c7b9827 No Types Assigned https://git.kernel.org/stable/c/c61d0b87a7028c2c10faffc524d748334c7b9827 Patch Changed Reference Type https://git.kernel.org/stable/c/c61d0b87a7028c2c10faffc524d748334c7b9827 No Types Assigned https://git.kernel.org/stable/c/c61d0b87a7028c2c10faffc524d748334c7b9827 Patch -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/29346e217b8ab8a52889b88f00b268278d6b7668 Added Reference https://git.kernel.org/stable/c/2bff660e0ff349dee84dc4f6f6d10da4497f5b28 Added Reference https://git.kernel.org/stable/c/6d5c8862932d31a810b6545f7d69ecc124402c6e Added Reference https://git.kernel.org/stable/c/a48d2bcd23f2c98d575bc2f9b7a3fbd16aeea9eb Added Reference https://git.kernel.org/stable/c/c61d0b87a7028c2c10faffc524d748334c7b9827 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 28, 2024
Action Type Old Value New Value Removed Reference kernel.org http://www.openwall.com/lists/oss-security/2024/04/11/9 Removed Reference kernel.org http://www.openwall.com/lists/oss-security/2024/04/11/11 Removed Reference kernel.org http://www.openwall.com/lists/oss-security/2024/04/12/2 Removed Reference kernel.org http://www.openwall.com/lists/oss-security/2024/04/12/1 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 01, 2024
Action Type Old Value New Value Added Reference kernel.org http://www.openwall.com/lists/oss-security/2024/04/11/11 [No types assigned] Added Reference kernel.org http://www.openwall.com/lists/oss-security/2024/04/12/2 [No types assigned] Added Reference kernel.org http://www.openwall.com/lists/oss-security/2024/04/12/1 [No types assigned] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 01, 2024
Action Type Old Value New Value Added Reference kernel.org http://www.openwall.com/lists/oss-security/2024/04/11/9 [No types assigned] -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Mar. 02, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux" This reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239. The commit above is reverted as it did not solve the original issue. gsm_cleanup_mux() tries to free up the virtual ttys by calling gsm_dlci_release() for each available DLCI. There, dlci_put() is called to decrease the reference counter for the DLCI via tty_port_put() which finally calls gsm_dlci_free(). This already clears the pointer which is being checked in gsm_cleanup_mux() before calling gsm_dlci_release(). Therefore, it is not necessary to clear this pointer in gsm_cleanup_mux() as done in the reverted commit. The commit introduces a null pointer dereference: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x156/0x420 ? search_exception_tables+0x37/0x50 ? fixup_exception+0x21/0x310 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x26/0x30 ? tty_port_put+0x19/0xa0 gsmtty_cleanup+0x29/0x80 [n_gsm] release_one_tty+0x37/0xe0 process_one_work+0x1e6/0x3e0 worker_thread+0x4c/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe1/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> The actual issue is that nothing guards dlci_put() from being called multiple times while the tty driver was triggered but did not yet finished calling gsm_dlci_free(). Added Reference Linux https://git.kernel.org/stable/c/6d5c8862932d31a810b6545f7d69ecc124402c6e [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/a48d2bcd23f2c98d575bc2f9b7a3fbd16aeea9eb [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/c61d0b87a7028c2c10faffc524d748334c7b9827 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/2bff660e0ff349dee84dc4f6f6d10da4497f5b28 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/29346e217b8ab8a52889b88f00b268278d6b7668 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2023-52564 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2023-52564
weaknesses.