CVE-2023-53484

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

lib: cpu_rmap: Avoid use after free on rmap->obj array entries

When calling irq_set_affinity_notifier() with NULL at the notify

argument, it will cause freeing of the glue pointer in the

corresponding array entry but will leave the pointer in the array. A

subsequent call to free_irq_cpu_rmap() will try to free this entry again

leading to possible use after free.

Fix that by setting NULL to the array entry and checking that we have

non-zero at the array entry when iterating over the array in

free_irq_cpu_rmap().

The current code does not suffer from this since there are no cases

where irq_set_affinity_notifier(irq, NULL) (note the NULL passed for the

notify arg) is called, followed by a call to free_irq_cpu_rmap() so we

don't hit and issue. Subsequent patches in this series excersize this

flow, hence the required fix.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References