linux-cve-announce - CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024051729-CVE-2023-52670-a191@gregkh>
Date: Fri, 17 May 2024 16:01:31 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

rpmsg: virtio: Free driver_override when rpmsg_remove()

Free driver_override when rpmsg_remove(), otherwise
the following memory leak will occur:

unreferenced object 0xffff0000d55d7080 (size 128):
  comm "kworker/u8:2", pid 56, jiffies 4294893188 (age 214.272s)
  hex dump (first 32 bytes):
    72 70 6d 73 67 5f 6e 73 00 00 00 00 00 00 00 00  rpmsg_ns........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<000000009c94c9c1>] __kmem_cache_alloc_node+0x1f8/0x320
    [<000000002300d89b>] __kmalloc_node_track_caller+0x44/0x70
    [<00000000228a60c3>] kstrndup+0x4c/0x90
    [<0000000077158695>] driver_set_override+0xd0/0x164
    [<000000003e9c4ea5>] rpmsg_register_device_override+0x98/0x170
    [<000000001c0c89a8>] rpmsg_ns_register_device+0x24/0x30
    [<000000008bbf8fa2>] rpmsg_probe+0x2e0/0x3ec
    [<00000000e65a68df>] virtio_dev_probe+0x1c0/0x280
    [<00000000443331cc>] really_probe+0xbc/0x2dc
    [<00000000391064b1>] __driver_probe_device+0x78/0xe0
    [<00000000a41c9a5b>] driver_probe_device+0xd8/0x160
    [<000000009c3bd5df>] __device_attach_driver+0xb8/0x140
    [<0000000043cd7614>] bus_for_each_drv+0x7c/0xd4
    [<000000003b929a36>] __device_attach+0x9c/0x19c
    [<00000000a94e0ba8>] device_initial_probe+0x14/0x20
    [<000000003c999637>] bus_probe_device+0xa0/0xac

The Linux kernel CVE team has assigned CVE-2023-52670 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.13 with commit b0b03b811963 and fixed in 4.19.307 with commit 229ce47cbfdc
	Issue introduced in 4.13 with commit b0b03b811963 and fixed in 5.4.269 with commit dd50fe18c234
	Issue introduced in 4.13 with commit b0b03b811963 and fixed in 5.10.210 with commit 69ca89d80f2c
	Issue introduced in 4.13 with commit b0b03b811963 and fixed in 5.15.149 with commit 2d27a7b19cb3
	Issue introduced in 4.13 with commit b0b03b811963 and fixed in 6.1.76 with commit f4bb1d5daf77
	Issue introduced in 4.13 with commit b0b03b811963 and fixed in 6.6.15 with commit 4e6cef3fae5c
	Issue introduced in 4.13 with commit b0b03b811963 and fixed in 6.7.3 with commit 9a416d624e5f
	Issue introduced in 4.13 with commit b0b03b811963 and fixed in 6.8 with commit d5362c37e1f8

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52670
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/rpmsg/virtio_rpmsg_bus.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/229ce47cbfdc7d3a9415eb676abbfb77d676cb08
	https://git.kernel.org/stable/c/dd50fe18c234bd5ff22f658f4d414e8fa8cd6a5d
	https://git.kernel.org/stable/c/69ca89d80f2c8a1f5af429b955637beea7eead30
	https://git.kernel.org/stable/c/2d27a7b19cb354c6d04bcdc9239e261ff29858d6
	https://git.kernel.org/stable/c/f4bb1d5daf77b1a95a43277268adf0d1430c2346
	https://git.kernel.org/stable/c/4e6cef3fae5c164968118a13f3fe293700adc81a
	https://git.kernel.org/stable/c/9a416d624e5fb7246ea97c11fbfea7e0e27abf43
	https://git.kernel.org/stable/c/d5362c37e1f8a40096452fc201c30e705750e687