search

krnidhi / linux_4.19.72_CVE-2019-17133

Other
0 stars 0 forks source link

CVE-2023-52670 (Medium) detected in linuxlinux-4.19.87 #453

Open mend-bolt-for-github[bot] opened 3 weeks ago

mend-bolt-for-github[bot] commented 3 weeks ago

CVE-2023-52670 - Medium Severity Vulnerability

Vulnerable Library - linuxlinux-4.19.87

The Linux Kernel

Library home page: https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/?wsslib=linux

Found in HEAD commit: a8c2d46c1cd0446647c3cd07868b5b85ba2ae2f6

Found in base branch: master

Vulnerable Source Files (2)

/drivers/rpmsg/virtio_rpmsg_bus.c /drivers/rpmsg/virtio_rpmsg_bus.c

Vulnerability Details

In the Linux kernel, the following vulnerability has been resolved: rpmsg: virtio: Free driver_override when rpmsg_remove() Free driver_override when rpmsg_remove(), otherwise the following memory leak will occur: unreferenced object 0xffff0000d55d7080 (size 128): comm "kworker/u8:2", pid 56, jiffies 4294893188 (age 214.272s) hex dump (first 32 bytes): 72 70 6d 73 67 5f 6e 73 00 00 00 00 00 00 00 00 rpmsg_ns........ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000009c94c9c1>] __kmem_cache_alloc_node+0x1f8/0x320 [<000000002300d89b>] __kmalloc_node_track_caller+0x44/0x70 [<00000000228a60c3>] kstrndup+0x4c/0x90 [<0000000077158695>] driver_set_override+0xd0/0x164 [<000000003e9c4ea5>] rpmsg_register_device_override+0x98/0x170 [<000000001c0c89a8>] rpmsg_ns_register_device+0x24/0x30 [<000000008bbf8fa2>] rpmsg_probe+0x2e0/0x3ec [<00000000e65a68df>] virtio_dev_probe+0x1c0/0x280 [<00000000443331cc>] really_probe+0xbc/0x2dc [<00000000391064b1>] __driver_probe_device+0x78/0xe0 [<00000000a41c9a5b>] driver_probe_device+0xd8/0x160 [<000000009c3bd5df>] __device_attach_driver+0xb8/0x140 [<0000000043cd7614>] bus_for_each_drv+0x7c/0xd4 [<000000003b929a36>] __device_attach+0x9c/0x19c [<00000000a94e0ba8>] device_initial_probe+0x14/0x20 [<000000003c999637>] bus_probe_device+0xa0/0xac

Publish Date: 2024-05-17

URL: CVE-2023-52670

CVSS 3 Score Details (6.6)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Physical - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://lore.kernel.org/linux-cve-announce/2024051729-CVE-2023-52670-a191@gregkh/T/#u

Release Date: 2024-05-17

Fix Resolution: v4.19.307,v5.4.269,v5.10.210,v5.15.149,v6.1.76,v6.6.15,v6.7.3,v6.8

Step up your Open Source Security Game with Mend here

mend-bolt-for-github[bot] commented 3 weeks ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

mend-bolt-for-github[bot] commented 6 days ago

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.