CVE-2023-52847
Linux Lenovo BTTV Use After Free
Description
In the Linux kernel, the following vulnerability has been resolved: media: bttv: fix use after free error due to btv->timeout timer There may be some a race condition between timer function bttv_irq_timeout and bttv_remove. The timer is setup in probe and there is no timer_delete operation in remove function. When it hit kfree btv, the function might still be invoked, which will cause use after free bug. This bug is found by static analysis, it may be false positive. Fix it by adding del_timer_sync invoking to the remove function. cpu0 cpu1 bttv_probe ->timer_setup ->bttv_set_dma ->mod_timer; bttv_remove ->kfree(btv); ->bttv_irq_timeout ->USE btv
INFO
Published Date :
May 21, 2024, 4:15 p.m.
Last Modified :
Nov. 21, 2024, 8:40 a.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
Exploitability Score :
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2023-52847.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2023-52847 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2023-52847 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Mar. 04, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-362 Added CWE CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.6 from (excluding) 6.6.2 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 from (excluding) 6.5.12 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 from (excluding) 6.1.63 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 from (excluding) 5.15.139 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 from (excluding) 5.10.201 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 from (excluding) 5.4.261 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.15 from (excluding) 4.19.299 Added Reference Type CVE: https://git.kernel.org/stable/c/1871014d6ef4812ad11ef7d838d73ce09d632267 Types: Mailing List, Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/1871014d6ef4812ad11ef7d838d73ce09d632267 Types: Mailing List, Patch Added Reference Type CVE: https://git.kernel.org/stable/c/20568d06f6069cb835e05eed432edf962645d226 Types: Mailing List, Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/20568d06f6069cb835e05eed432edf962645d226 Types: Mailing List, Patch Added Reference Type CVE: https://git.kernel.org/stable/c/2f3d9198cdae1cb079ec8652f4defacd481eab2b Types: Mailing List, Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/2f3d9198cdae1cb079ec8652f4defacd481eab2b Types: Mailing List, Patch Added Reference Type CVE: https://git.kernel.org/stable/c/51c94256a83fe4e17406c66ff3e1ad7d242d8574 Types: Mailing List, Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/51c94256a83fe4e17406c66ff3e1ad7d242d8574 Types: Mailing List, Patch Added Reference Type CVE: https://git.kernel.org/stable/c/847599fffa528b2cdec4e21b6bf7586dad982132 Types: Mailing List, Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/847599fffa528b2cdec4e21b6bf7586dad982132 Types: Mailing List, Patch Added Reference Type CVE: https://git.kernel.org/stable/c/b35fdade92c5058a5e727e233fe263b828de2c9a Types: Mailing List, Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b35fdade92c5058a5e727e233fe263b828de2c9a Types: Mailing List, Patch Added Reference Type CVE: https://git.kernel.org/stable/c/bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9 Types: Mailing List, Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9 Types: Mailing List, Patch Added Reference Type CVE: https://git.kernel.org/stable/c/bd5b50b329e850d467e7bcc07b2b6bde3752fbda Types: Mailing List, Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/bd5b50b329e850d467e7bcc07b2b6bde3752fbda Types: Mailing List, Patch -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/1871014d6ef4812ad11ef7d838d73ce09d632267 Added Reference https://git.kernel.org/stable/c/20568d06f6069cb835e05eed432edf962645d226 Added Reference https://git.kernel.org/stable/c/2f3d9198cdae1cb079ec8652f4defacd481eab2b Added Reference https://git.kernel.org/stable/c/51c94256a83fe4e17406c66ff3e1ad7d242d8574 Added Reference https://git.kernel.org/stable/c/847599fffa528b2cdec4e21b6bf7586dad982132 Added Reference https://git.kernel.org/stable/c/b35fdade92c5058a5e727e233fe263b828de2c9a Added Reference https://git.kernel.org/stable/c/bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9 Added Reference https://git.kernel.org/stable/c/bd5b50b329e850d467e7bcc07b2b6bde3752fbda -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 29, 2024
Action Type Old Value New Value -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 21, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: media: bttv: fix use after free error due to btv->timeout timer There may be some a race condition between timer function bttv_irq_timeout and bttv_remove. The timer is setup in probe and there is no timer_delete operation in remove function. When it hit kfree btv, the function might still be invoked, which will cause use after free bug. This bug is found by static analysis, it may be false positive. Fix it by adding del_timer_sync invoking to the remove function. cpu0 cpu1 bttv_probe ->timer_setup ->bttv_set_dma ->mod_timer; bttv_remove ->kfree(btv); ->bttv_irq_timeout ->USE btv Added Reference kernel.org https://git.kernel.org/stable/c/bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/b35fdade92c5058a5e727e233fe263b828de2c9a [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/2f3d9198cdae1cb079ec8652f4defacd481eab2b [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/51c94256a83fe4e17406c66ff3e1ad7d242d8574 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/20568d06f6069cb835e05eed432edf962645d226 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/1871014d6ef4812ad11ef7d838d73ce09d632267 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/847599fffa528b2cdec4e21b6bf7586dad982132 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/bd5b50b329e850d467e7bcc07b2b6bde3752fbda [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2023-52847 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2023-52847
weaknesses.