CVE-2023-52486 drm: Don't unref the same fb many times by mistake due to deadlock handling
A use-after-free vulnerability in the Linux kernel DRM subsystem allows attackers to cause denial of service or potentially execute code via improper framebuffer reference counting during deadlock handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52486?
CVE-2023-52486 is a high-severity use after free vulnerability in Linux kernel, published on 29 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm: Don't unref the same fb many times by mistake due to deadlock handling
If we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl() we proceed to unref the fb and then retry the whole thing from the top. But we forget to reset the fb pointer back to NULL, and so if we then get another error during the retry, before the fb lookup, we proceed the unref the same fb again without having gotten another reference. The end result is that the fb will (eventually) end up being freed while it's still in use.
Reset fb to NULL once we've unreffed it to avoid doing it again until we've done another fb lookup.
This turned out to be pretty easy to hit on a DG2 when doing async flips (and CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y). The first symptom I saw that drm_closefb() simply got stuck in a busy loop while walking the framebuffer list. Fortunately I was able to convince it to oops instead, and from there it was easier to track down the culprit.
Weakness: CWE-667
Which versions are affected by CVE-2023-52486?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-52486?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-52486 being exploited?
There is no known exploitation of CVE-2023-52486 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-52486, DEBIAN-CVE-2023-52486, GHSA-ph55-5xqf-59r7, UBUNTU-CVE-2023-52486.