CVE-2023-52635

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PM / devfreq: Synchronize devfreq_monitor_[start/stop]

There is a chance if a frequent switch of the governor

done in a loop result in timer list corruption where

timer cancel being done from two place one from

cancel_delayed_work_sync() and followed by expire_timers()

can be seen from the traces[1].

while true

do

echo "simple_ondemand" > /sys/class/devfreq/1d84000.ufshc/governor

echo "performance" > /sys/class/devfreq/1d84000.ufshc/governor

done

It looks to be issue with devfreq driver where

device_monitor_[start/stop] need to synchronized so that

delayed work should get corrupted while it is either

being queued or running or being cancelled.

Let's use polling flag and devfreq lock to synchronize the

queueing the timer instance twice and work data being

corrupted.

[1]

...

..

<idle>-0 [003] 9436.209662: timer_cancel timer=0xffffff80444f0428

<idle>-0 [003] 9436.209664: timer_expire_en

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References