CVE-2023-52629

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sh: push-switch: reordenar las operaciones de limpieza para evitar el error de use after free. El código original coloca Flush_work() antes de timer_shutdown_sync() en switch_drv_remove(). Aunque usamos Flush_work() para detener al trabajador, podría reprogramarse en switch_timer(). Como resultado, puede ocurrir un error de use after free. Los detalles se muestran a continuación: (cpu 0) | (procesador 1) switch_drv_remove() | descarga_trabajo() | ... | switch_timer // temporizador | Schedule_work(&psw->trabajo) timer_shutdown_sync() | ... | switch_work_handler // trabajador kfree(psw) // gratis | | psw->state = 0 // uso Este parche coloca timer_shutdown_sync() antes de Flush_work() para mitigar los errores. Como resultado, el trabajador y el temporizador se detendrán de forma segura antes de las operaciones de desasignación.

In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug The original code puts flush_work() before timer_shutdown_sync() in switch_drv_remove(). Although we use flush_work() to stop the worker, it could be rescheduled in switch_timer(). As a result, a use-after-free bug can occur. The details are shown below: (cpu 0) | (cpu 1) switch_drv_remove() | flush_work() | ... | switch_timer // timer | schedule_work(&psw->work) timer_shutdown_sync() | ... | switch_work_handler // worker kfree(psw) // free | | psw->state = 0 // use This patch puts timer_shutdown_sync() before flush_work() to mitigate the bugs. As a result, the worker and timer will be stopped safely before the deallocate operations.

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.