SECUFOCUSNOW
Home›CVE index›CVE-2023-52438
Review reviewHigh

CVE-2023-52438

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in shinker's callback The mmap read lock is used during the shrinker's callback, which means that using alloc->vma pointer isn't safe as it can race with munmap(). As of commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap") the mmap lock is downgraded after the vma has been isolated. I was able to reproduce this issue by manually adding some delays and triggering page reclaiming through the shrinker's debug sysfs. The following KASAN report confirms the UAF: ====================...

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2024.02.21
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in shinker's callback The mmap read lock is used during the shrinker's callback, which means that using alloc->vma pointer isn't safe as it can race with munmap(). As of commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap") the mmap lock is downgraded after the vma has been isolated. I was able to reproduce this issue by manually adding some delays and triggering page reclaiming through the shrinker's debug sysfs. The following KASAN report confirms the UAF: ====================...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= dd2283f2605e3b3e9c61bcae844b34f2afa4813f < a53e15e592b4dcc91c3a3b8514e484a0bdbc53a3, >= dd2283f2605e3b3e9c61bcae844b34f2afa4813f < c8c1158ffb007197f31f9d9170cf13e4f34cbb5c, >= dd2283f2605e3b3e9c61bcae844b34f2afa4813f < 8ad4d580e8aff8de2a4d57c5930fcc29f1ffd4a6, >= dd2283f2605e3b3e9c61bcae844b34f2afa4813f < 9fa04c93f24138747807fe75b5591bb680098f56, >= dd2283f2605e3b3e9c61bcae844b34f2afa4813f < a49087ab93508b60d9b8add91707a22dda832869, >= dd2283f2605e3b3e9c61bcae844b34f2afa4813f < e074686e993ff1be5f21b085a3b1b4275ccd5727, >= dd2283f2605e3b3e9c61bcae844b34f2afa4813f < 3f489c2067c5824528212b0fc18b28d51332d906, >= 4.20, >= 4.20.0 < 5.4.268, >= 5.5.0 < 5.10.209, >= 5.11.0 < 5.15.148, >= 5.16.0 < 6.1.74, >= 6.2.0 < 6.6.13, >= 6.7.0 < 6.7.1
Fixed versions
5.4.268, 5.10.209, 5.15.148, 6.1.74, 6.6.13, 6.7.1

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416