CVE-2023-53587

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Sync IRQ works before buffer destruction If something was written to the buffer just before destruction, it may be possible (maybe not in a real system, but it did happen in ARCH=um with time-travel) to destroy the ringbuffer before the IRQ work ran, leading this KASAN report (or a crash without KASAN): BUG: KASAN: slab-use-after-free in irq_work_run_list+0x11a/0x13a Read of size 8 at addr 000000006d640a48 by task swapper/0 CPU: 0 PID: 0 Comm: swapper Tainted: G W O 6.3.0-rc1 #7 Stack: 60c4f20f 0c203d48 41b58ab...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < 372c5ee537b8366b64b691ba29e9335525e1655e, >= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < 2702b67f59d455072a08dc40312f9b090d4dec04, >= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < 2399b1fda025e939b6fb1ac94505bcf718534e65, >= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < 1c99f65d6af2a454bfd5207b4f6a97c8474a1191, >= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < c63741e872fcfb10e153517750f7908f0c00f60d, >= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < d9834abd8b24d1fe8092859e436fe1e0fd467c61, >= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < fc6858b7f8e1221f62ce8c6ff8a13a349c32cd76, >= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < 0a65165bd24ee9231191597b7c232376fcd70cdb, >= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < 675751bb20634f981498c7d66161584080cc061e, >= 3.10, >= 3.10 < 4.14.315, >= 4.15 < 4.19.283, >= 4.20 < 5.4.243, >= 5.5 < 5.10.180, >= 5.11 < 5.15.111, >= 5.16 < 6.1.28, >= 6.2 < 6.2.15, >= 6.3 < 6.3.2

Fixed versions

4.14.315, 4.19.283, 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416