跳转到帖子

Ubuntu: (CVE-2023-52564): linux vulnerability

recommended_posts

发布于
  • Members

Ubuntu: (CVE-2023-52564): linux vulnerability

Severity
5
CVSS
(AV:L/AC:L/Au:S/C:N/I:N/A:C)
Published
03/02/2024
Created
11/21/2024
Added
11/19/2024
Modified
02/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved: Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux" This reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239. The commit above is reverted as it did not solve the original issue. gsm_cleanup_mux() tries to free up the virtual ttys by calling gsm_dlci_release() for each available DLCI. There, dlci_put() is called to decrease the reference counter for the DLCI via tty_port_put() which finally calls gsm_dlci_free(). This already clears the pointer which is being checked in gsm_cleanup_mux() before calling gsm_dlci_release(). Therefore, it is not necessary to clear this pointer in gsm_cleanup_mux() as done in the reverted commit. The commit introduces a null pointer dereference: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x156/0x420 ? search_exception_tables+0x37/0x50 ? fixup_exception+0x21/0x310 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x26/0x30 ? tty_port_put+0x19/0xa0 gsmtty_cleanup+0x29/0x80 [n_gsm] release_one_tty+0x37/0xe0 process_one_work+0x1e6/0x3e0 worker_thread+0x4c/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe1/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> The actual issue is that nothing guards dlci_put() from being called multiple times while the tty driver was triggered but did not yet finished calling gsm_dlci_free().

Solution(s)

  • ubuntu-upgrade-linux
  • ubuntu-upgrade-linux-aws
  • ubuntu-upgrade-linux-aws-5-15
  • ubuntu-upgrade-linux-aws-fips
  • ubuntu-upgrade-linux-azure
  • ubuntu-upgrade-linux-azure-5-15
  • ubuntu-upgrade-linux-azure-fde
  • ubuntu-upgrade-linux-azure-fde-5-15
  • ubuntu-upgrade-linux-bluefield
  • ubuntu-upgrade-linux-fips
  • ubuntu-upgrade-linux-gcp
  • ubuntu-upgrade-linux-gcp-5-15
  • ubuntu-upgrade-linux-gcp-6-5
  • ubuntu-upgrade-linux-gcp-fips
  • ubuntu-upgrade-linux-gke
  • ubuntu-upgrade-linux-gkeop
  • ubuntu-upgrade-linux-gkeop-5-15
  • ubuntu-upgrade-linux-hwe-5-15
  • ubuntu-upgrade-linux-hwe-6-5
  • ubuntu-upgrade-linux-ibm
  • ubuntu-upgrade-linux-ibm-5-15
  • ubuntu-upgrade-linux-intel-iot-realtime
  • ubuntu-upgrade-linux-intel-iotg
  • ubuntu-upgrade-linux-intel-iotg-5-15
  • ubuntu-upgrade-linux-kvm
  • ubuntu-upgrade-linux-laptop
  • ubuntu-upgrade-linux-lowlatency
  • ubuntu-upgrade-linux-lowlatency-hwe-5-15
  • ubuntu-upgrade-linux-lowlatency-hwe-6-5
  • ubuntu-upgrade-linux-nvidia
  • ubuntu-upgrade-linux-nvidia-6-5
  • ubuntu-upgrade-linux-oem-6-5
  • ubuntu-upgrade-linux-oracle
  • ubuntu-upgrade-linux-oracle-5-15
  • ubuntu-upgrade-linux-oracle-6-5
  • ubuntu-upgrade-linux-raspi
  • ubuntu-upgrade-linux-realtime
  • ubuntu-upgrade-linux-riscv
  • ubuntu-upgrade-linux-riscv-5-15
  • ubuntu-upgrade-linux-starfive
  • ubuntu-upgrade-linux-xilinx-zynqmp

References

  • https://attackerkb.com/topics/cve-2023-52564
  • CVE - 2023-52564
  • https://git.kernel.org/linus/29346e217b8ab8a52889b88f00b268278d6b7668
  • https://www.cve.org/CVERecord?id=CVE-2023-52564
  • 查看数 703
  • 已创建
  • 最后回复

参与讨论

你可立刻发布并稍后注册。 如果你有帐户,立刻登录发布帖子。
注意:你的帖子需要版主批准后才能看到。

游客
回帖…