From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: CVE-2023-52840: Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
Date: Tue, 21 May 2024 17:32:16 +0200 [thread overview]
Message-ID: <2024052111-CVE-2023-52840-8a3d@gregkh> (raw)
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
The put_device() calls rmi_release_function() which frees "fn" so the
dereference on the next line "fn->num_of_irqs" is a use after free.
Move the put_device() to the end to fix this.
The Linux kernel CVE team has assigned CVE-2023-52840 to this issue.
Affected and fixed versions
===========================
Issue introduced in 4.18 with commit 24d28e4f1271 and fixed in 4.19.299 with commit 2f236d8638f5
Issue introduced in 4.18 with commit 24d28e4f1271 and fixed in 5.4.261 with commit 50d122536661
Issue introduced in 4.18 with commit 24d28e4f1271 and fixed in 5.10.201 with commit 6c71e065befb
Issue introduced in 4.18 with commit 24d28e4f1271 and fixed in 5.15.139 with commit 303766bb92c5
Issue introduced in 4.18 with commit 24d28e4f1271 and fixed in 6.1.63 with commit 7082b1fb5321
Issue introduced in 4.18 with commit 24d28e4f1271 and fixed in 6.5.12 with commit cc56c4d17721
Issue introduced in 4.18 with commit 24d28e4f1271 and fixed in 6.6.2 with commit c8e639f5743c
Issue introduced in 4.18 with commit 24d28e4f1271 and fixed in 6.7 with commit eb988e46da2e
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2023-52840
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
drivers/input/rmi4/rmi_bus.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/2f236d8638f5b43e0c72919a6a27fe286c32053f
https://git.kernel.org/stable/c/50d12253666195a14c6cd2b81c376e2dbeedbdff
https://git.kernel.org/stable/c/6c71e065befb2fae8f1461559b940c04e1071bd5
https://git.kernel.org/stable/c/303766bb92c5c225cf40f9bbbe7e29749406e2f2
https://git.kernel.org/stable/c/7082b1fb5321037bc11ba1cf2d7ed23c6b2b521f
https://git.kernel.org/stable/c/cc56c4d17721dcb10ad4e9c9266e449be1462683
https://git.kernel.org/stable/c/c8e639f5743cf4b01f8c65e0df075fe4d782b585
https://git.kernel.org/stable/c/eb988e46da2e4eae89f5337e047ce372fe33d5b1
reply other threads:[~2024-05-21 15:38 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2024052111-CVE-2023-52840-8a3d@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.