CVE-2023-53854

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: mediatek: mt8186: Fix use-after-free in driver remove path

When devm runs function in the "remove" path for a device it runs them

in the reverse order. That means that if you have parts of your driver

that aren't using devm or are using "roll your own" devm w/

devm_add_action_or_reset() you need to keep that in mind.

The mt8186 audio driver didn't quite get this right. Specifically, in

mt8186_init_clock() it called mt8186_audsys_clk_register() and then

went on to call a bunch of other devm function. The caller of

mt8186_init_clock() used devm_add_action_or_reset() to call

mt8186_deinit_clock() but, because of the intervening devm functions,

the order was wrong.

Specifically at probe time, the order was:

1. mt8186_audsys_clk_register()

2. afe_priv->clk = devm_kcalloc(...)

3. afe_priv->clk[i] = devm_clk_get(...)

At remove time, the order (which should have been 3, 2, 1) was:

1. mt8186_audsys_clk_unregister()

3

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References