https://vulnerability.circl.lu/sightings/feed 2026-05-07T00:09:48.516377+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/c2eb780f-11f2-4d7f-8330-016fddba9538/export 2026-05-07T00:09:48.901961+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "c2eb780f-11f2-4d7f-8330-016fddba9538", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-53123", "type": "seen", "source": "https://t.me/cvedetector/24366", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2023-53123 - Linux Kernel PCI s390 Use-After-Free Vulnerability\", \n \"Content\": \"CVE ID : CVE-2023-53123 \nPublished : May 2, 2025, 4:15 p.m. | 1\u00a0hour, 4\u00a0minutes ago \nDescription : In the Linux kernel, the following vulnerability has been resolved: \n \nPCI: s390: Fix use-after-free of PCI resources with per-function hotplug \n \nOn s390 PCI functions may be hotplugged individually even when they \nbelong to a multi-function device. In particular on an SR-IOV device VFs \nmay be removed and later re-added. \n \nIn commit a50297cf8235 (\"s390/pci: separate zbus creation from \nscanning\") it was missed however that struct pci_bus and struct \nzpci_bus's resource list retained a reference to the PCI functions MMIO \nresources even though those resources are released and freed on \nhot-unplug. These stale resources may subsequently be claimed when the \nPCI function re-appears resulting in use-after-free. \n \nOne idea of fixing this use-after-free in s390 specific code that was \ninvestigated was to simply keep resources around from the moment a PCI \nfunction first appeared until the whole virtual PCI bus created for \na multi-function device disappears. The problem with this however is \nthat due to the requirement of artificial MMIO addreesses (address \ncookies) extra logic is then needed to keep the address cookies \ncompatible on re-plug. At the same time the MMIO resources semantically \nbelong to the PCI function so tying their lifecycle to the function \nseems more logical. \n \nInstead a simpler approach is to remove the resources of an individually \nhot-unplugged PCI function from the PCI bus's resource list while \nkeeping the resources of other PCI functions on the PCI bus untouched. \n \nThis is done by introducing pci_bus_remove_resource() to remove an \nindividual resource. Similarly the resource also needs to be removed \nfrom the struct zpci_bus's resource list. It turns out however, that \nthere is really no need to add the MMIO resources to the struct \nzpci_bus's resource list at all and instead we can simply use the \nzpci_bar_struct's resource pointer directly. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n \"Detection Date\": \"02 May 2025\",\n \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-05-02T20:07:55.000000Z"} 2025-05-02T20:07:55+00:00