CVE-2023-52617 PCI: switchtec: Fix stdev_release() crash after surprise hot remove
A use-after-free vulnerability in the Linux kernel Switchtec driver allows a local attacker to cause a system crash via surprise hot removal.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52617?
CVE-2023-52617 is a medium-severity use after free vulnerability in Debian Debian Linux, published on 18 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
PCI: switchtec: Fix stdev_release() crash after surprise hot remove
A PCI device hot removal may occur while stdev->cdev is held open. The call to stdev_release() then happens during close or exit, at a point way past switchtec_pci_remove(). Otherwise the last ref would vanish with the trailing put_device(), just before return.
At that later point in time, the devm cleanup has already removed the stdev->mmio_mrpc mapping. Also, the stdev->pdev reference was not a counted one. Therefore, in DMA mode, the iowrite32() in stdev_release() will cause a fatal page fault, and the subsequent dma_free_coherent(), if reached, would pass a stale &stdev->pdev->dev pointer.
Fix by moving MRPC DMA shutdown into switchtec_pci_remove(), after stdev_kill(). Counting the stdev->pdev ref is now optional, but may prevent future accidents.
Reproducible via the script at https://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com
Weakness: CWE-459
Which versions are affected by CVE-2023-52617?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2023-52617?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-52617 being exploited?
There is no known exploitation of CVE-2023-52617 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BELL-CVE-2023-52617, DEBIAN-CVE-2023-52617, GHSA-62pr-mr57-m7xm, UBUNTU-CVE-2023-52617.