Name | CVE-2023-52617 |
Description | In the Linux kernel, the following vulnerability has been resolved: PCI: switchtec: Fix stdev_release() crash after surprise hot remove A PCI device hot removal may occur while stdev->cdev is held open. The call to stdev_release() then happens during close or exit, at a point way past switchtec_pci_remove(). Otherwise the last ref would vanish with the trailing put_device(), just before return. At that later point in time, the devm cleanup has already removed the stdev->mmio_mrpc mapping. Also, the stdev->pdev reference was not a counted one. Therefore, in DMA mode, the iowrite32() in stdev_release() will cause a fatal page fault, and the subsequent dma_free_coherent(), if reached, would pass a stale &stdev->pdev->dev pointer. Fix by moving MRPC DMA shutdown into switchtec_pci_remove(), after stdev_kill(). Counting the stdev->pdev ref is now optional, but may prevent future accidents. Reproducible via the script at https://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com |
Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
Source Package | Release | Version | Status |
---|---|---|---|
linux (PTS) | jessie, jessie (lts) | 3.16.84-1 | vulnerable |
stretch (security) | 4.9.320-2 | vulnerable | |
stretch (lts), stretch | 4.9.320-3 | vulnerable | |
buster | 4.19.249-2 | vulnerable | |
buster (security) | 4.19.304-1 | vulnerable | |
bullseye | 5.10.209-2 | vulnerable | |
bullseye (security) | 5.10.205-2 | vulnerable | |
bookworm | 6.1.76-1 | vulnerable | |
bookworm (security) | 6.1.85-1 | fixed | |
trixie | 6.6.15-2 | vulnerable | |
sid | 6.7.12-1 | fixed |
The information below is based on the following data on fixed versions.
Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
---|---|---|---|---|---|---|
linux | source | jessie | (unfixed) | end-of-life | ||
linux | source | stretch | (unfixed) | end-of-life | ||
linux | source | bookworm | 6.1.82-1 | |||
linux | source | (unstable) | 6.7.7-1 |
https://git.kernel.org/linus/df25461119d987b8c81d232cfe4411e91dcabe66 (6.8-rc1)