Log in Start free

Vulnerability · Published Feb 25, 2024 · Assigned by Linux

CVE-2023-52468class: fix use-after-free in class_register()

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.3%top 80.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: class: fix use-after-free in class_register() The lock_class_key is still registered and can be found in lock_keys_hash hlist after subsys_private is freed in error handler path.A task who iterate over the lock_keys_hash later may cause use-after-free.So fix that up and unregister the lock_class_key before kfree(cp). On our platform, a driver fails to kset_register because of creating duplicate filename '/class/xxx'.With Kasan enabled, it prints a invalid-access bug report. KASAN bug report: BUG: KASAN: invalid-access in lockdep_register_key+0x19c/0x1bc Write of size 8 at addr 15ffff808b8c0368 by task modprobe/252 Pointer tag: [15], memory tag: [fe] CPU: 7 PID: 252 Comm: modprobe Tainted: G W 6.6.0-mainline-maybe-dirty #1 Call trace: dump_backtrace+0x1b0/0x1e4 show_stack+0x2c/0x40 dump_stack_lvl+0xac/0xe0 print_report+0x18c/0x4d8 kasan_report+0xe8/0x148 __hwasan_store8_noabort+0x88/0x98 lockdep_register_key+0x19c/0x1bc class_register+0x94/0x1ec init_module+0xbc/0xf48 [rfkill] do_one_initcall+0x17c/0x72c do_init_module+0x19c/0x3f8 ... Memory state around the buggy address: ffffff808b8c0100: 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a ffffff808b8c0200: 8a 8a 8a 8a 8a 8a 8a 8a fe fe fe fe fe fe fe fe >ffffff808b8c0300: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ^ ffffff808b8c0400: 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 As CONFIG_KASAN_GENERIC is not set, Kasan reports invalid-access not use-after-free here.In this case, modprobe is manipulating the corrupted lock_keys_hash hlish where lock_class_key is already freed before. It's worth noting that this only can happen if lockdep is enabled, which is not true for normal system.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.6.15-1DEBIAN-CVE-2023-52468
Debian:14linux6.6.15-1DEBIAN-CVE-2023-52468
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-azure-6.56.5.0-1022.23~22.04.1USN-6819-1
Ubuntu:22.04:LTSlinux-azure-6.56.5.0-1022.23~22.04.1UBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-gcp-6.56.5.0-1022.24~22.04.1USN-6818-1
Ubuntu:22.04:LTSlinux-gcp-6.56.5.0-1022.24~22.04.1UBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-hwe-6.56.5.0-41.41~22.04.2USN-6818-4
Ubuntu:22.04:LTSlinux-hwe-6.56.5.0-41.41~22.04.2UBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.56.5.0-41.41.1~22.04.1USN-6818-1
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.56.5.0-41.41.1~22.04.1UBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-nvidia-6.56.5.0-1021.22USN-6818-3
Ubuntu:22.04:LTSlinux-nvidia-6.56.5.0-1021.22UBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-oem-6.56.5.0-1024.25UBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-oem-6.56.5.0-1024.25USN-6819-3
Ubuntu:22.04:LTSlinux-oracle-6.56.5.0-1024.24~22.04.1USN-6819-4
Ubuntu:22.04:LTSlinux-oracle-6.56.5.0-1024.24~22.04.1UBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-riscv-6.56.5.0-40.40.1~22.04.1UBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-starfive-6.56.5.0-1015.16~22.04.1UBUNTU-CVE-2023-52468
Ubuntu:22.04:LTSlinux-starfive-6.56.5.0-1015.16~22.04.1USN-6819-1

Affected products (as reported)

VendorProductVersions
Linux Linux dcfbb67e48a2becfce7990386e985b9c45098ee5 – before b57196a5ec5e4c0ffecde8348b085b778c7dce04dcfbb67e48a2becfce7990386e985b9c45098ee5 – before 0f1486dafca3398c4c46b9f6e6452fa27e73b559dcfbb67e48a2becfce7990386e985b9c45098ee5 – before 93ec4a3b76404bce01bd5c9032bef5df6feb1d62
Linux Linux 6.4

References