CVE-2023-52643 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: iio: core: fix memleak in iio_device_register_sysfs When iio_device_register_sysfs_group() fails, we should free iio_dev_opaque->chan_attr_group.attrs to prevent potential memleak.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Redhat	Enterprise Linux

No data.

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 9
kernel-0:5.14.0-503.11.1.el9_5	cpe:/a:redhat:enterprise_linux:9	RHSA-2024:9315	2024-11-12T00:00:00Z
kernel-0:5.14.0-503.11.1.el9_5	cpe:/o:redhat:enterprise_linux:9	RHSA-2024:9315	2024-11-12T00:00:00Z

References

Link	Providers
https://git.kernel.org/stable/c/1c6d19c8cbf6abcea2c8fca2db26abca2cbf0363
https://git.kernel.org/stable/c/359f220d0e753bba840eac19ffedcdc816b532f2
https://git.kernel.org/stable/c/3db312e06851996e7fb27cb5a8ccab4c0f9cdb93
https://git.kernel.org/stable/c/95a0d596bbd0552a78e13ced43f2be1038883c81
https://git.kernel.org/stable/c/b90126c86d83912688501826643ea698f0df1728
https://lore.kernel.org/linux-cve-announce/2024041701-CVE-2023-52643-8834@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2023-52643
https://www.cve.org/CVERecord?id=CVE-2023-52643

History

Wed, 13 Nov 2024 02:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat enterprise Linux
CPEs		cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Vendors & Products		Redhat Redhat enterprise Linux

Mon, 04 Nov 2024 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-04-17T09:43:45.813Z

Updated: 2024-11-04T14:50:19.494Z

Reserved: 2024-03-06T09:52:12.094Z

Link: CVE-2023-52643

Vulnrichment

Updated: 2024-08-02T23:03:21.364Z

NVD

Status : Awaiting Analysis

Published: 2024-04-17T10:15:08.503

Modified: 2024-04-17T12:48:07.510

Link: CVE-2023-52643

Redhat

Severity : Low

Publid Date: 2024-04-17T00:00:00Z

Links: CVE-2023-52643 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-52643", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-06T09:52:12.094Z", "datePublished": "2024-04-17T09:43:45.813Z", "dateUpdated": "2024-11-04T14:50:19.494Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T14:50:19.494Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: core: fix memleak in iio_device_register_sysfs\n\nWhen iio_device_register_sysfs_group() fails, we should\nfree iio_dev_opaque->chan_attr_group.attrs to prevent\npotential memleak."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iio/industrialio-core.c"], "versions": [{"version": "32f171724e5c", "lessThan": "1c6d19c8cbf6", "status": "affected", "versionType": "git"}, {"version": "32f171724e5c", "lessThan": "359f220d0e75", "status": "affected", "versionType": "git"}, {"version": "32f171724e5c", "lessThan": "b90126c86d83", "status": "affected", "versionType": "git"}, {"version": "32f171724e5c", "lessThan": "3db312e06851", "status": "affected", "versionType": "git"}, {"version": "32f171724e5c", "lessThan": "95a0d596bbd0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iio/industrialio-core.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.149", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.79", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.18", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.6", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/1c6d19c8cbf6abcea2c8fca2db26abca2cbf0363"}, {"url": "https://git.kernel.org/stable/c/359f220d0e753bba840eac19ffedcdc816b532f2"}, {"url": "https://git.kernel.org/stable/c/b90126c86d83912688501826643ea698f0df1728"}, {"url": "https://git.kernel.org/stable/c/3db312e06851996e7fb27cb5a8ccab4c0f9cdb93"}, {"url": "https://git.kernel.org/stable/c/95a0d596bbd0552a78e13ced43f2be1038883c81"}], "title": "iio: core: fix memleak in iio_device_register_sysfs", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-17T19:25:15.574768Z", "id": "CVE-2023-52643", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T19:25:23.334Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:03:21.364Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/1c6d19c8cbf6abcea2c8fca2db26abca2cbf0363", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/359f220d0e753bba840eac19ffedcdc816b532f2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b90126c86d83912688501826643ea698f0df1728", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3db312e06851996e7fb27cb5a8ccab4c0f9cdb93", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/95a0d596bbd0552a78e13ced43f2be1038883c81", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/1c6d19c8cbf6abcea2c8fca2db26abca2cbf0363", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/359f220d0e753bba840eac19ffedcdc816b532f2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b90126c86d83912688501826643ea698f0df1728", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3db312e06851996e7fb27cb5a8ccab4c0f9cdb93", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/95a0d596bbd0552a78e13ced43f2be1038883c81", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:03:21.364Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52643", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-17T19:25:15.574768Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T19:25:19.622Z"}}], "cna": {"title": "iio: core: fix memleak in iio_device_register_sysfs", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "32f171724e5c", "lessThan": "1c6d19c8cbf6", "versionType": "git"}, {"status": "affected", "version": "32f171724e5c", "lessThan": "359f220d0e75", "versionType": "git"}, {"status": "affected", "version": "32f171724e5c", "lessThan": "b90126c86d83", "versionType": "git"}, {"status": "affected", "version": "32f171724e5c", "lessThan": "3db312e06851", "versionType": "git"}, {"status": "affected", "version": "32f171724e5c", "lessThan": "95a0d596bbd0", "versionType": "git"}], "programFiles": ["drivers/iio/industrialio-core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"status": "unaffected", "version": "0", "lessThan": "5.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.149", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.79", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.18", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.6", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/iio/industrialio-core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/1c6d19c8cbf6abcea2c8fca2db26abca2cbf0363"}, {"url": "https://git.kernel.org/stable/c/359f220d0e753bba840eac19ffedcdc816b532f2"}, {"url": "https://git.kernel.org/stable/c/b90126c86d83912688501826643ea698f0df1728"}, {"url": "https://git.kernel.org/stable/c/3db312e06851996e7fb27cb5a8ccab4c0f9cdb93"}, {"url": "https://git.kernel.org/stable/c/95a0d596bbd0552a78e13ced43f2be1038883c81"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: core: fix memleak in iio_device_register_sysfs\n\nWhen iio_device_register_sysfs_group() fails, we should\nfree iio_dev_opaque->chan_attr_group.attrs to prevent\npotential memleak."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T14:50:19.494Z"}}}, "cveMetadata": {"cveId": "CVE-2023-52643", "state": "PUBLISHED", "dateUpdated": "2024-11-04T14:50:19.494Z", "dateReserved": "2024-03-06T09:52:12.094Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-17T09:43:45.813Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"affected_release": [{"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}], "bugzilla": {"description": "kernel: iio: core: fix memleak in iio_device_register_sysfs", "id": "2275624", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2275624"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-402", "details": ["In the Linux kernel, the following vulnerability has been resolved:\niio: core: fix memleak in iio_device_register_sysfs\nWhen iio_device_register_sysfs_group() fails, we should\nfree iio_dev_opaque->chan_attr_group.attrs to prevent\npotential memleak."], "name": "CVE-2023-52643", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-52643\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-52643\nhttps://lore.kernel.org/linux-cve-announce/2024041701-CVE-2023-52643-8834@gregkh/T"], "threat_severity": "Low", "upstream_fix": "kernel 5.15.149, kernel 6.1.79, kernel 6.6.18, kernel 6.7.6, kernel 6.8"}