// For flags

CVE-2023-52670

rpmsg: virtio: Free driver_override when rpmsg_remove()

Severity Score

6.6
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

In the Linux kernel, the following vulnerability has been resolved:

rpmsg: virtio: Free driver_override when rpmsg_remove()

Free driver_override when rpmsg_remove(), otherwise
the following memory leak will occur:

unreferenced object 0xffff0000d55d7080 (size 128):
comm "kworker/u8:2", pid 56, jiffies 4294893188 (age 214.272s)
hex dump (first 32 bytes):
72 70 6d 73 67 5f 6e 73 00 00 00 00 00 00 00 00 rpmsg_ns........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<000000009c94c9c1>] __kmem_cache_alloc_node+0x1f8/0x320
[<000000002300d89b>] __kmalloc_node_track_caller+0x44/0x70
[<00000000228a60c3>] kstrndup+0x4c/0x90
[<0000000077158695>] driver_set_override+0xd0/0x164
[<000000003e9c4ea5>] rpmsg_register_device_override+0x98/0x170
[<000000001c0c89a8>] rpmsg_ns_register_device+0x24/0x30
[<000000008bbf8fa2>] rpmsg_probe+0x2e0/0x3ec
[<00000000e65a68df>] virtio_dev_probe+0x1c0/0x280
[<00000000443331cc>] really_probe+0xbc/0x2dc
[<00000000391064b1>] __driver_probe_device+0x78/0xe0
[<00000000a41c9a5b>] driver_probe_device+0xd8/0x160
[<000000009c3bd5df>] __device_attach_driver+0xb8/0x140
[<0000000043cd7614>] bus_for_each_drv+0x7c/0xd4
[<000000003b929a36>] __device_attach+0x9c/0x19c
[<00000000a94e0ba8>] device_initial_probe+0x14/0x20
[<000000003c999637>] bus_probe_device+0xa0/0xac

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rpmsg: virtio: Free driver_overridecuando rpmsg_remove() Free driver_override cuando rpmsg_remove(); de lo contrario, se producirá la siguiente pérdida de memoria: objeto sin referencia 0xffff0000d55d7080 (tamaño 128): comm "kworker/u8 :2", pid 56, santiamén 4294893188 (edad 214.272s) volcado hexadecimal (primeros 32 bytes): 72 70 6d 73 67 5f 6e 73 00 00 00 00 00 00 00 00 rpmsg_ns........ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ retroceso: [&lt;000000009c94c9c1&gt;] __kmem_cache_alloc_node+0x1f8/0x320 [&lt;000000002300d89b&gt;] +0x44/ 0x70 [&lt;00000000228a60c3&gt;] kstrndup+0x4c/0x90 [&lt;0000000077158695&gt;] driver_set_override+0xd0/0x164 [&lt;000000003e9c4ea5&gt;] rpmsg_register_device_override+0x98/0x170 0000001c0c89a8&gt;] rpmsg_ns_register_device+0x24/0x30 [&lt;000000008bbf8fa2&gt;] rpmsg_probe+0x2e0/ 0x3ec [&lt;00000000e65a68df&gt;] virtio_dev_probe+0x1c0/0x280 [&lt;00000000443331cc&gt;] very_probe+0xbc/0x2dc [&lt;00000000391064b1&gt;] __driver_probe_device+0x78/0xe0 [&lt;00 000000a41c9a5b&gt;] driver_probe_device+0xd8/0x160 [&lt;000000009c3bd5df&gt;] __device_attach_driver+0xb8/ 0x140 [&lt;0000000043cd7614&gt;] bus_for_each_drv+0x7c/0xd4 [&lt;000000003b929a36&gt;] __device_attach+0x9c/0x19c [&lt;00000000a94e0ba8&gt;] dispositivo_initial_probe+0x14/0x20 [&lt;000 000003c999637&gt;] bus_probe_device+0xa0/0xac

*Credits: N/A
CVSS Scores
Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-03-07 CVE Reserved
  • 2024-05-17 CVE Published
  • 2024-05-18 EPSS Updated
  • 2024-12-19 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-401: Missing Release of Memory after Effective Lifetime
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 4.13 < 4.19.307
Search vendor "Linux" for product "Linux Kernel" and version " >= 4.13 < 4.19.307"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 4.13 < 5.4.269
Search vendor "Linux" for product "Linux Kernel" and version " >= 4.13 < 5.4.269"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 4.13 < 5.10.210
Search vendor "Linux" for product "Linux Kernel" and version " >= 4.13 < 5.10.210"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 4.13 < 5.15.149
Search vendor "Linux" for product "Linux Kernel" and version " >= 4.13 < 5.15.149"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 4.13 < 6.1.76
Search vendor "Linux" for product "Linux Kernel" and version " >= 4.13 < 6.1.76"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 4.13 < 6.6.15
Search vendor "Linux" for product "Linux Kernel" and version " >= 4.13 < 6.6.15"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 4.13 < 6.7.3
Search vendor "Linux" for product "Linux Kernel" and version " >= 4.13 < 6.7.3"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 4.13 < 6.8
Search vendor "Linux" for product "Linux Kernel" and version " >= 4.13 < 6.8"
en
Affected