CVE-2023-52564

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"

This reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239.

The commit above is reverted as it did not solve the original issue.

gsm_cleanup_mux() tries to free up the virtual ttys by calling

gsm_dlci_release() for each available DLCI. There, dlci_put() is called to

decrease the reference counter for the DLCI via tty_port_put() which

finally calls gsm_dlci_free(). This already clears the pointer which is

being checked in gsm_cleanup_mux() before calling gsm_dlci_release().

Therefore, it is not necessary to clear this pointer in gsm_cleanup_mux()

as done in the reverted commit. The commit introduces a null pointer

dereference:

<TASK>

? __die+0x1f/0x70

? page_fault_oops+0x156/0x420

? search_exception_tables+0x37/0x50

? fixup_exception+0x21/0x310

? exc_page_fault+0x69/0x150

? asm_exc_page_fault+0x26/0x30

? tty_port_put+0x19/0xa0

gsmtty_cleanup+0x29/0x80 [n_gsm

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References