CVE-2023-52629

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sh: push-switch: Reorder cleanup operations to avoid use-after-free bug

The original code puts flush_work() before timer_shutdown_sync()

in switch_drv_remove(). Although we use flush_work() to stop

the worker, it could be rescheduled in switch_timer(). As a result,

a use-after-free bug can occur. The details are shown below:

(cpu 0) | (cpu 1)

switch_drv_remove() |

flush_work() |

... | switch_timer // timer

| schedule_work(&psw->work)

timer_shutdown_sync() |

... | switch_work_handler // worker

kfree(psw) // free |

| psw->state = 0 // use

This patch puts timer_shutdown_sync() before flush_work() to

mitigate the bugs. As a result, the worker and timer will be

stopped safely before the deallocate operatio

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References