CVE-2023-52795 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix use after free in vhost_vdpa_probe() The put_device() calls vhost_vdpa_release_dev() which calls ida_simple_remove() and frees "v". So this call to ida_simple_remove() is a use after free and a double free.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/ae8ea4e200675a940c365b496ef8e3fb4123601c
https://git.kernel.org/stable/c/bf04132cd64ccde4e9e9765d489c83fe83c09b7f
https://git.kernel.org/stable/c/c0f8b8fb7df9d1a38652eb5aa817afccd3c56111
https://git.kernel.org/stable/c/e07754e0a1ea2d63fb29574253d1fd7405607343
https://lore.kernel.org/linux-cve-announce/2024052157-CVE-2023-52795-4811@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2023-52795
https://www.cve.org/CVERecord?id=CVE-2023-52795

History

Mon, 04 Nov 2024 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-21T15:31:09.623Z

Updated: 2024-11-04T14:52:52.450Z

Reserved: 2024-05-21T15:19:24.246Z

Link: CVE-2023-52795

Vulnrichment

Updated: 2024-08-02T23:11:35.679Z

NVD

Status : Awaiting Analysis

Published: 2024-05-21T16:15:18.073

Modified: 2024-05-21T16:53:56.550

Link: CVE-2023-52795

Redhat

Severity : Low

Publid Date: 2024-05-21T00:00:00Z

Links: CVE-2023-52795 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-52795", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T15:19:24.246Z", "datePublished": "2024-05-21T15:31:09.623Z", "dateUpdated": "2024-11-04T14:52:52.450Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T14:52:52.450Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-vdpa: fix use after free in vhost_vdpa_probe()\n\nThe put_device() calls vhost_vdpa_release_dev() which calls\nida_simple_remove() and frees \"v\". So this call to\nida_simple_remove() is a use after free and a double free."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vhost/vdpa.c"], "versions": [{"version": "ebe6a354fa7e", "lessThan": "c0f8b8fb7df9", "status": "affected", "versionType": "git"}, {"version": "ebe6a354fa7e", "lessThan": "ae8ea4e20067", "status": "affected", "versionType": "git"}, {"version": "ebe6a354fa7e", "lessThan": "bf04132cd64c", "status": "affected", "versionType": "git"}, {"version": "ebe6a354fa7e", "lessThan": "e07754e0a1ea", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vhost/vdpa.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.64", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.5.13", "lessThanOrEqual": "6.5.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.3", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/c0f8b8fb7df9d1a38652eb5aa817afccd3c56111"}, {"url": "https://git.kernel.org/stable/c/ae8ea4e200675a940c365b496ef8e3fb4123601c"}, {"url": "https://git.kernel.org/stable/c/bf04132cd64ccde4e9e9765d489c83fe83c09b7f"}, {"url": "https://git.kernel.org/stable/c/e07754e0a1ea2d63fb29574253d1fd7405607343"}], "title": "vhost-vdpa: fix use after free in vhost_vdpa_probe()", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52795", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-29T17:45:54.468862Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:23:53.184Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:11:35.679Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/c0f8b8fb7df9d1a38652eb5aa817afccd3c56111", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ae8ea4e200675a940c365b496ef8e3fb4123601c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/bf04132cd64ccde4e9e9765d489c83fe83c09b7f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e07754e0a1ea2d63fb29574253d1fd7405607343", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/c0f8b8fb7df9d1a38652eb5aa817afccd3c56111", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ae8ea4e200675a940c365b496ef8e3fb4123601c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/bf04132cd64ccde4e9e9765d489c83fe83c09b7f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e07754e0a1ea2d63fb29574253d1fd7405607343", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:11:35.679Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52795", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-29T17:45:54.468862Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-29T17:45:59.713Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "vhost-vdpa: fix use after free in vhost_vdpa_probe()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ebe6a354fa7e", "lessThan": "c0f8b8fb7df9", "versionType": "git"}, {"status": "affected", "version": "ebe6a354fa7e", "lessThan": "ae8ea4e20067", "versionType": "git"}, {"status": "affected", "version": "ebe6a354fa7e", "lessThan": "bf04132cd64c", "versionType": "git"}, {"status": "affected", "version": "ebe6a354fa7e", "lessThan": "e07754e0a1ea", "versionType": "git"}], "programFiles": ["drivers/vhost/vdpa.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"status": "unaffected", "version": "0", "lessThan": "6.0", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.64", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.5.13", "versionType": "semver", "lessThanOrEqual": "6.5.*"}, {"status": "unaffected", "version": "6.6.3", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/vhost/vdpa.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/c0f8b8fb7df9d1a38652eb5aa817afccd3c56111"}, {"url": "https://git.kernel.org/stable/c/ae8ea4e200675a940c365b496ef8e3fb4123601c"}, {"url": "https://git.kernel.org/stable/c/bf04132cd64ccde4e9e9765d489c83fe83c09b7f"}, {"url": "https://git.kernel.org/stable/c/e07754e0a1ea2d63fb29574253d1fd7405607343"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-vdpa: fix use after free in vhost_vdpa_probe()\n\nThe put_device() calls vhost_vdpa_release_dev() which calls\nida_simple_remove() and frees \"v\". So this call to\nida_simple_remove() is a use after free and a double free."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T14:52:52.450Z"}}}, "cveMetadata": {"cveId": "CVE-2023-52795", "state": "PUBLISHED", "dateUpdated": "2024-11-04T14:52:52.450Z", "dateReserved": "2024-05-21T15:19:24.246Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-21T15:31:09.623Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}