CVE-2023-52635 (GCVE-0-2023-52635)

Vulnerability from cvelistv5 – Published: 2024-04-02 06:49 – Updated: 2026-05-11 19:30
VLAI?
Title
PM / devfreq: Synchronize devfreq_monitor_[start/stop]
Summary
In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Synchronize devfreq_monitor_[start/stop] There is a chance if a frequent switch of the governor done in a loop result in timer list corruption where timer cancel being done from two place one from cancel_delayed_work_sync() and followed by expire_timers() can be seen from the traces[1]. while true do echo "simple_ondemand" > /sys/class/devfreq/1d84000.ufshc/governor echo "performance" > /sys/class/devfreq/1d84000.ufshc/governor done It looks to be issue with devfreq driver where device_monitor_[start/stop] need to synchronized so that delayed work should get corrupted while it is either being queued or running or being cancelled. Let's use polling flag and devfreq lock to synchronize the queueing the timer instance twice and work data being corrupted. [1] ... .. <idle>-0 [003] 9436.209662: timer_cancel timer=0xffffff80444f0428 <idle>-0 [003] 9436.209664: timer_expire_entry timer=0xffffff80444f0428 now=0x10022da1c function=__typeid__ZTSFvP10timer_listE_global_addr baseclk=0x10022da1c <idle>-0 [003] 9436.209718: timer_expire_exit timer=0xffffff80444f0428 kworker/u16:6-14217 [003] 9436.209863: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2b now=0x10022da1c flags=182452227 vendor.xxxyyy.ha-1593 [004] 9436.209888: timer_cancel timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216390: timer_init timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216392: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2c now=0x10022da1d flags=186646532 vendor.xxxyyy.ha-1593 [005] 9436.220992: timer_cancel timer=0xffffff80444f0428 xxxyyyTraceManag-7795 [004] 9436.261641: timer_cancel timer=0xffffff80444f0428 [2] 9436.261653][ C4] Unable to handle kernel paging request at virtual address dead00000000012a [ 9436.261664][ C4] Mem abort info: [ 9436.261666][ C4] ESR = 0x96000044 [ 9436.261669][ C4] EC = 0x25: DABT (current EL), IL = 32 bits [ 9436.261671][ C4] SET = 0, FnV = 0 [ 9436.261673][ C4] EA = 0, S1PTW = 0 [ 9436.261675][ C4] Data abort info: [ 9436.261677][ C4] ISV = 0, ISS = 0x00000044 [ 9436.261680][ C4] CM = 0, WnR = 1 [ 9436.261682][ C4] [dead00000000012a] address between user and kernel address ranges [ 9436.261685][ C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP [ 9436.261701][ C4] Skip md ftrace buffer dump for: 0x3a982d0 ... [ 9436.262138][ C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S W O 5.10.149-android12-9-o-g17f915d29d0c #1 [ 9436.262141][ C4] Hardware name: Qualcomm Technologies, Inc. (DT) [ 9436.262144][ C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--) [ 9436.262161][ C4] pc : expire_timers+0x9c/0x438 [ 9436.262164][ C4] lr : expire_timers+0x2a4/0x438 [ 9436.262168][ C4] sp : ffffffc010023dd0 [ 9436.262171][ C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18 [ 9436.262178][ C4] x27: ffffffd063569dd0 x26: ffffffd063536008 [ 9436.262182][ C4] x25: 0000000000000001 x24: ffffff88f7c69280 [ 9436.262185][ C4] x23: 00000000000000e0 x22: dead000000000122 [ 9436.262188][ C4] x21: 000000010022da29 x20: ffffff8af72b4e80 [ 9436.262191][ C4] x19: ffffffc010023e50 x18: ffffffc010025038 [ 9436.262195][ C4] x17: 0000000000000240 x16: 0000000000000201 [ 9436.262199][ C4] x15: ffffffffffffffff x14: ffffff889f3c3100 [ 9436.262203][ C4] x13: ffffff889f3c3100 x12: 00000000049f56b8 [ 9436.262207][ C4] x11: 00000000049f56b8 x10: 00000000ffffffff [ 9436.262212][ C4] x9 : ffffffc010023e50 x8 : dead000000000122 [ 9436.262216][ C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8 [ 9436.262220][ C4] x5 : 0000000000000000 x4 : 0000000000000101 [ 9436.262223][ C4] x3 : 0000000000000080 x2 : ffffff8 ---truncated---
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7e6fdd4bad033fa2d73716377b184fa975b0d985 , < 3399cc7013e761fee9d6eec795e9b31ab0cbe475 (git)
Affected: 7e6fdd4bad033fa2d73716377b184fa975b0d985 , < 099f6a9edbe30b142c1d97fe9a4748601d995675 (git)
Affected: 7e6fdd4bad033fa2d73716377b184fa975b0d985 , < 31569995fc65007b73a3fff605ec2b3401b435e9 (git)
Affected: 7e6fdd4bad033fa2d73716377b184fa975b0d985 , < 0aedb319ef3ed39e9e5a7b7726c8264ca627bbd9 (git)
Affected: 7e6fdd4bad033fa2d73716377b184fa975b0d985 , < ae815e2fdc284ab31651d52460698bd89c0fce22 (git)
Affected: 7e6fdd4bad033fa2d73716377b184fa975b0d985 , < aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6 (git)
Create a notification for this product.
Linux Linux Affected: 3.8
Unaffected: 0 , < 3.8 (semver)
Unaffected: 5.10.210 , ≤ 5.10.* (semver)
Unaffected: 5.15.149 , ≤ 5.15.* (semver)
Unaffected: 6.1.77 , ≤ 6.1.* (semver)
Unaffected: 6.6.16 , ≤ 6.6.* (semver)
Unaffected: 6.7.4 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52635",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T19:30:55.797428Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T19:31:03.162Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:21.345Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3399cc7013e761fee9d6eec795e9b31ab0cbe475"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/099f6a9edbe30b142c1d97fe9a4748601d995675"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/31569995fc65007b73a3fff605ec2b3401b435e9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0aedb319ef3ed39e9e5a7b7726c8264ca627bbd9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ae815e2fdc284ab31651d52460698bd89c0fce22"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/devfreq/devfreq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3399cc7013e761fee9d6eec795e9b31ab0cbe475",
              "status": "affected",
              "version": "7e6fdd4bad033fa2d73716377b184fa975b0d985",
              "versionType": "git"
            },
            {
              "lessThan": "099f6a9edbe30b142c1d97fe9a4748601d995675",
              "status": "affected",
              "version": "7e6fdd4bad033fa2d73716377b184fa975b0d985",
              "versionType": "git"
            },
            {
              "lessThan": "31569995fc65007b73a3fff605ec2b3401b435e9",
              "status": "affected",
              "version": "7e6fdd4bad033fa2d73716377b184fa975b0d985",
              "versionType": "git"
            },
            {
              "lessThan": "0aedb319ef3ed39e9e5a7b7726c8264ca627bbd9",
              "status": "affected",
              "version": "7e6fdd4bad033fa2d73716377b184fa975b0d985",
              "versionType": "git"
            },
            {
              "lessThan": "ae815e2fdc284ab31651d52460698bd89c0fce22",
              "status": "affected",
              "version": "7e6fdd4bad033fa2d73716377b184fa975b0d985",
              "versionType": "git"
            },
            {
              "lessThan": "aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6",
              "status": "affected",
              "version": "7e6fdd4bad033fa2d73716377b184fa975b0d985",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/devfreq/devfreq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "lessThan": "3.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.210",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.149",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.77",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.16",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.4",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM / devfreq: Synchronize devfreq_monitor_[start/stop]\n\nThere is a chance if a frequent switch of the governor\ndone in a loop result in timer list corruption where\ntimer cancel being done from two place one from\ncancel_delayed_work_sync() and followed by expire_timers()\ncan be seen from the traces[1].\n\nwhile true\ndo\n        echo \"simple_ondemand\" \u003e /sys/class/devfreq/1d84000.ufshc/governor\n        echo \"performance\" \u003e /sys/class/devfreq/1d84000.ufshc/governor\ndone\n\nIt looks to be issue with devfreq driver where\ndevice_monitor_[start/stop] need to synchronized so that\ndelayed work should get corrupted while it is either\nbeing queued or running or being cancelled.\n\nLet\u0027s use polling flag and devfreq lock to synchronize the\nqueueing the timer instance twice and work data being\ncorrupted.\n\n[1]\n...\n..\n\u003cidle\u003e-0    [003]   9436.209662:  timer_cancel   timer=0xffffff80444f0428\n\u003cidle\u003e-0    [003]   9436.209664:  timer_expire_entry   timer=0xffffff80444f0428  now=0x10022da1c  function=__typeid__ZTSFvP10timer_listE_global_addr  baseclk=0x10022da1c\n\u003cidle\u003e-0    [003]   9436.209718:  timer_expire_exit   timer=0xffffff80444f0428\nkworker/u16:6-14217    [003]   9436.209863:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2b  now=0x10022da1c  flags=182452227\nvendor.xxxyyy.ha-1593    [004]   9436.209888:  timer_cancel   timer=0xffffff80444f0428\nvendor.xxxyyy.ha-1593    [004]   9436.216390:  timer_init   timer=0xffffff80444f0428\nvendor.xxxyyy.ha-1593    [004]   9436.216392:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2c  now=0x10022da1d  flags=186646532\nvendor.xxxyyy.ha-1593    [005]   9436.220992:  timer_cancel   timer=0xffffff80444f0428\nxxxyyyTraceManag-7795    [004]   9436.261641:  timer_cancel   timer=0xffffff80444f0428\n\n[2]\n\n 9436.261653][    C4] Unable to handle kernel paging request at virtual address dead00000000012a\n[ 9436.261664][    C4] Mem abort info:\n[ 9436.261666][    C4]   ESR = 0x96000044\n[ 9436.261669][    C4]   EC = 0x25: DABT (current EL), IL = 32 bits\n[ 9436.261671][    C4]   SET = 0, FnV = 0\n[ 9436.261673][    C4]   EA = 0, S1PTW = 0\n[ 9436.261675][    C4] Data abort info:\n[ 9436.261677][    C4]   ISV = 0, ISS = 0x00000044\n[ 9436.261680][    C4]   CM = 0, WnR = 1\n[ 9436.261682][    C4] [dead00000000012a] address between user and kernel address ranges\n[ 9436.261685][    C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP\n[ 9436.261701][    C4] Skip md ftrace buffer dump for: 0x3a982d0\n...\n\n[ 9436.262138][    C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S      W  O      5.10.149-android12-9-o-g17f915d29d0c #1\n[ 9436.262141][    C4] Hardware name: Qualcomm Technologies, Inc.  (DT)\n[ 9436.262144][    C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--)\n[ 9436.262161][    C4] pc : expire_timers+0x9c/0x438\n[ 9436.262164][    C4] lr : expire_timers+0x2a4/0x438\n[ 9436.262168][    C4] sp : ffffffc010023dd0\n[ 9436.262171][    C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18\n[ 9436.262178][    C4] x27: ffffffd063569dd0 x26: ffffffd063536008\n[ 9436.262182][    C4] x25: 0000000000000001 x24: ffffff88f7c69280\n[ 9436.262185][    C4] x23: 00000000000000e0 x22: dead000000000122\n[ 9436.262188][    C4] x21: 000000010022da29 x20: ffffff8af72b4e80\n[ 9436.262191][    C4] x19: ffffffc010023e50 x18: ffffffc010025038\n[ 9436.262195][    C4] x17: 0000000000000240 x16: 0000000000000201\n[ 9436.262199][    C4] x15: ffffffffffffffff x14: ffffff889f3c3100\n[ 9436.262203][    C4] x13: ffffff889f3c3100 x12: 00000000049f56b8\n[ 9436.262207][    C4] x11: 00000000049f56b8 x10: 00000000ffffffff\n[ 9436.262212][    C4] x9 : ffffffc010023e50 x8 : dead000000000122\n[ 9436.262216][    C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8\n[ 9436.262220][    C4] x5 : 0000000000000000 x4 : 0000000000000101\n[ 9436.262223][    C4] x3 : 0000000000000080 x2 : ffffff8\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:30:46.727Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3399cc7013e761fee9d6eec795e9b31ab0cbe475"
        },
        {
          "url": "https://git.kernel.org/stable/c/099f6a9edbe30b142c1d97fe9a4748601d995675"
        },
        {
          "url": "https://git.kernel.org/stable/c/31569995fc65007b73a3fff605ec2b3401b435e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aedb319ef3ed39e9e5a7b7726c8264ca627bbd9"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae815e2fdc284ab31651d52460698bd89c0fce22"
        },
        {
          "url": "https://git.kernel.org/stable/c/aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6"
        }
      ],
      "title": "PM / devfreq: Synchronize devfreq_monitor_[start/stop]",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52635",
    "datePublished": "2024-04-02T06:49:13.143Z",
    "dateReserved": "2024-03-06T09:52:12.092Z",
    "dateUpdated": "2026-05-11T19:30:46.727Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52635",
      "date": "2026-05-19",
      "epss": "0.00024",
      "percentile": "0.06739"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nPM / devfreq: Synchronize devfreq_monitor_[start/stop]\\n\\nThere is a chance if a frequent switch of the governor\\ndone in a loop result in timer list corruption where\\ntimer cancel being done from two place one from\\ncancel_delayed_work_sync() and followed by expire_timers()\\ncan be seen from the traces[1].\\n\\nwhile true\\ndo\\n        echo \\\"simple_ondemand\\\" \u003e /sys/class/devfreq/1d84000.ufshc/governor\\n        echo \\\"performance\\\" \u003e /sys/class/devfreq/1d84000.ufshc/governor\\ndone\\n\\nIt looks to be issue with devfreq driver where\\ndevice_monitor_[start/stop] need to synchronized so that\\ndelayed work should get corrupted while it is either\\nbeing queued or running or being cancelled.\\n\\nLet\u0027s use polling flag and devfreq lock to synchronize the\\nqueueing the timer instance twice and work data being\\ncorrupted.\\n\\n[1]\\n...\\n..\\n\u003cidle\u003e-0    [003]   9436.209662:  timer_cancel   timer=0xffffff80444f0428\\n\u003cidle\u003e-0    [003]   9436.209664:  timer_expire_entry   timer=0xffffff80444f0428  now=0x10022da1c  function=__typeid__ZTSFvP10timer_listE_global_addr  baseclk=0x10022da1c\\n\u003cidle\u003e-0    [003]   9436.209718:  timer_expire_exit   timer=0xffffff80444f0428\\nkworker/u16:6-14217    [003]   9436.209863:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2b  now=0x10022da1c  flags=182452227\\nvendor.xxxyyy.ha-1593    [004]   9436.209888:  timer_cancel   timer=0xffffff80444f0428\\nvendor.xxxyyy.ha-1593    [004]   9436.216390:  timer_init   timer=0xffffff80444f0428\\nvendor.xxxyyy.ha-1593    [004]   9436.216392:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2c  now=0x10022da1d  flags=186646532\\nvendor.xxxyyy.ha-1593    [005]   9436.220992:  timer_cancel   timer=0xffffff80444f0428\\nxxxyyyTraceManag-7795    [004]   9436.261641:  timer_cancel   timer=0xffffff80444f0428\\n\\n[2]\\n\\n 9436.261653][    C4] Unable to handle kernel paging request at virtual address dead00000000012a\\n[ 9436.261664][    C4] Mem abort info:\\n[ 9436.261666][    C4]   ESR = 0x96000044\\n[ 9436.261669][    C4]   EC = 0x25: DABT (current EL), IL = 32 bits\\n[ 9436.261671][    C4]   SET = 0, FnV = 0\\n[ 9436.261673][    C4]   EA = 0, S1PTW = 0\\n[ 9436.261675][    C4] Data abort info:\\n[ 9436.261677][    C4]   ISV = 0, ISS = 0x00000044\\n[ 9436.261680][    C4]   CM = 0, WnR = 1\\n[ 9436.261682][    C4] [dead00000000012a] address between user and kernel address ranges\\n[ 9436.261685][    C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP\\n[ 9436.261701][    C4] Skip md ftrace buffer dump for: 0x3a982d0\\n...\\n\\n[ 9436.262138][    C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S      W  O      5.10.149-android12-9-o-g17f915d29d0c #1\\n[ 9436.262141][    C4] Hardware name: Qualcomm Technologies, Inc.  (DT)\\n[ 9436.262144][    C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--)\\n[ 9436.262161][    C4] pc : expire_timers+0x9c/0x438\\n[ 9436.262164][    C4] lr : expire_timers+0x2a4/0x438\\n[ 9436.262168][    C4] sp : ffffffc010023dd0\\n[ 9436.262171][    C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18\\n[ 9436.262178][    C4] x27: ffffffd063569dd0 x26: ffffffd063536008\\n[ 9436.262182][    C4] x25: 0000000000000001 x24: ffffff88f7c69280\\n[ 9436.262185][    C4] x23: 00000000000000e0 x22: dead000000000122\\n[ 9436.262188][    C4] x21: 000000010022da29 x20: ffffff8af72b4e80\\n[ 9436.262191][    C4] x19: ffffffc010023e50 x18: ffffffc010025038\\n[ 9436.262195][    C4] x17: 0000000000000240 x16: 0000000000000201\\n[ 9436.262199][    C4] x15: ffffffffffffffff x14: ffffff889f3c3100\\n[ 9436.262203][    C4] x13: ffffff889f3c3100 x12: 00000000049f56b8\\n[ 9436.262207][    C4] x11: 00000000049f56b8 x10: 00000000ffffffff\\n[ 9436.262212][    C4] x9 : ffffffc010023e50 x8 : dead000000000122\\n[ 9436.262216][    C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8\\n[ 9436.262220][    C4] x5 : 0000000000000000 x4 : 0000000000000101\\n[ 9436.262223][    C4] x3 : 0000000000000080 x2 : ffffff8\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: PM / devfreq: Sincronizar devfreq_monitor_[start/stop] Existe la posibilidad de que un cambio frecuente del gobernador realizado en un bucle provoque corrupci\\u00f3n en la lista de temporizadores, donde la cancelaci\\u00f3n del temporizador se realiza desde dos coloque uno de cancel_delayed_work_sync() y seguido de expire_timers() se puede ver en los rastros [1]. mientras que es verdadero, haga echo \\\"simple_ondemand\\\" \u0026gt; /sys/class/devfreq/1d84000.ufshc/governor echo \\\"rendimiento\\\" \u0026gt; /sys/class/devfreq/1d84000.ufshc/governor done Parece ser un problema con el controlador devfreq donde device_monitor_[start /stop] debe sincronizarse para que el trabajo retrasado se corrompa mientras est\\u00e1 en cola, ejecut\\u00e1ndose o cancel\\u00e1ndose. Usemos el indicador de sondeo y el bloqueo devfreq para sincronizar la cola de la instancia del temporizador dos veces y los datos de trabajo que se corrompen. [1] ... .. -0 [003] 9436.209662: timer_cancel timer=0xffffff80444f0428 -0 [003] 9436.209664: timer_expire_entry timer=0xffffff80444f0428 now=0x10022da1c function=__typeid__ZTS FvP10timer_listE_global_addr baseclk=0x10022da1c -0 [003] 9436.209718: timer_expire_exit timer=0xffffff80444f0428 kworker/u16:6-14217 [003] 9436.209863: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expira = 0x10022da2b ahora = 0x10022da1c banderas = 182452227 proveedor.xxxyyy.ha-1593 [004] 9436.209888: timer_cancel temporizador=0xffffff80444f0428 proveedor.xxxyyy.ha-1593 [004] 9436.216390: timer_init temporizador=0xffffff80444f0428 proveedor.xxxyyy.ha-1593 [004] 9436.216392: timer_start temporizador=0xffffff80444f042 8 funci\\u00f3n=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2c ahora=0x10022da1d flags=186646532 proveedor.xxxyyy .ha-1593 [005] 9436.220992: timer_cancel timer=0xffffff80444f0428 xxxyyyTraceManag-7795 [004] 9436.261641: timer_cancel timer=0xffffff80444f0428 [2] 9436.261653][ C4] No se puede para manejar la solicitud de paginaci\\u00f3n del kernel en la direcci\\u00f3n virtual dead00000000012a [ 9436.261664][ C4] Mem informaci\\u00f3n de cancelaci\\u00f3n: [ 9436.261666][ C4] ESR = 0x96000044 [ 9436.261669][ C4] EC = 0x25: DABT (EL actual), IL = 32 bits [ 9436.261671][ C4] SET = 0, FnV = 0 [ 9436.261673][ C4 ] EA = 0, S1PTW = 0 [ 9436.261675][ C4] Informaci\\u00f3n de cancelaci\\u00f3n de datos: [ 9436.261677][ C4] ISV = 0, ISS = 0x00000044 [ 9436.261680][ C4] CM = 0, WnR = 1 [ 9436.261682][ C4] [dead00000000012a] direcci\\u00f3n entre los rangos de direcciones del usuario y del kernel [ 9436.261685][ C4] Error interno: Vaya: 96000044 [#1] SMP PREEMPT [ 9436.261701][ C4] Omitir el volcado del b\\u00fafer md ftrace para: 0x3a982d0 ... [ 9436.262138][ C4 ] CPU: 4 PID: 7795 Comunicaciones: TraceManag Tainted: GSWO 5.10.149-android12-9-o-g17f915d29d0c #1 [ 9436.262141][ C4] Nombre de hardware: Qualcomm Technologies, Inc. (DT) [ 9436.262144][ C4] pstate : 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--) [ 9436.262161][ C4] pc : expire_timers+0x9c/0x438 [ 9436.262164][ C4] lr : expire_timers+0x2a4/0x438 [ 9436.262168][ C4] sp : ffffffc010023dd0 [ 9436.262171][ C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18 [ 9436.262178][ C4] x27: ffffffd063569dd0 x26: ffffffd063536008 [ 9436 .262182][ C4] x25: 0000000000000001 x24: ffffff88f7c69280 [ 9436.262185][ C4] x23: 00000000000000e0 x22: muerto000000000122 [ 9436.262188][ C4] x21: 000000010022da29 x20: ffffff8af72b4e80 [ 9436.262191][ C4] x19: ffffffc010023e50 x18: ffffffc010025038 [ 9436.262195][ C4] x 17: 0000000000000240 x16: 0000000000000201 [ 9436.262199][ C4] x15: ffffffffffffffff x14: ffffff889f3c3100 [ 9436.262203] [ C4] x13: ffffff889f3c3100 x12: 00000000049f56b8 [ 9436.262207][ C4] x11: 00000000049f56b8 x10: 00000000ffffffff [ 9436.262212][ C4] x9 : ffffffc0 10023e50 x8: muerto000000000122 [9436.262216][C4] x7: ffffffffffffffff x6: ffffffc0100239d8 [9436.262220][C4 ]---truncado---\"}]",
      "id": "CVE-2023-52635",
      "lastModified": "2024-11-21T08:40:15.147",
      "published": "2024-04-02T07:15:41.260",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/099f6a9edbe30b142c1d97fe9a4748601d995675\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/0aedb319ef3ed39e9e5a7b7726c8264ca627bbd9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/31569995fc65007b73a3fff605ec2b3401b435e9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/3399cc7013e761fee9d6eec795e9b31ab0cbe475\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ae815e2fdc284ab31651d52460698bd89c0fce22\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/099f6a9edbe30b142c1d97fe9a4748601d995675\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/0aedb319ef3ed39e9e5a7b7726c8264ca627bbd9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/31569995fc65007b73a3fff605ec2b3401b435e9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/3399cc7013e761fee9d6eec795e9b31ab0cbe475\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ae815e2fdc284ab31651d52460698bd89c0fce22\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52635\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-02T07:15:41.260\",\"lastModified\":\"2025-03-17T15:13:50.523\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nPM / devfreq: Synchronize devfreq_monitor_[start/stop]\\n\\nThere is a chance if a frequent switch of the governor\\ndone in a loop result in timer list corruption where\\ntimer cancel being done from two place one from\\ncancel_delayed_work_sync() and followed by expire_timers()\\ncan be seen from the traces[1].\\n\\nwhile true\\ndo\\n        echo \\\"simple_ondemand\\\" \u003e /sys/class/devfreq/1d84000.ufshc/governor\\n        echo \\\"performance\\\" \u003e /sys/class/devfreq/1d84000.ufshc/governor\\ndone\\n\\nIt looks to be issue with devfreq driver where\\ndevice_monitor_[start/stop] need to synchronized so that\\ndelayed work should get corrupted while it is either\\nbeing queued or running or being cancelled.\\n\\nLet\u0027s use polling flag and devfreq lock to synchronize the\\nqueueing the timer instance twice and work data being\\ncorrupted.\\n\\n[1]\\n...\\n..\\n\u003cidle\u003e-0    [003]   9436.209662:  timer_cancel   timer=0xffffff80444f0428\\n\u003cidle\u003e-0    [003]   9436.209664:  timer_expire_entry   timer=0xffffff80444f0428  now=0x10022da1c  function=__typeid__ZTSFvP10timer_listE_global_addr  baseclk=0x10022da1c\\n\u003cidle\u003e-0    [003]   9436.209718:  timer_expire_exit   timer=0xffffff80444f0428\\nkworker/u16:6-14217    [003]   9436.209863:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2b  now=0x10022da1c  flags=182452227\\nvendor.xxxyyy.ha-1593    [004]   9436.209888:  timer_cancel   timer=0xffffff80444f0428\\nvendor.xxxyyy.ha-1593    [004]   9436.216390:  timer_init   timer=0xffffff80444f0428\\nvendor.xxxyyy.ha-1593    [004]   9436.216392:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2c  now=0x10022da1d  flags=186646532\\nvendor.xxxyyy.ha-1593    [005]   9436.220992:  timer_cancel   timer=0xffffff80444f0428\\nxxxyyyTraceManag-7795    [004]   9436.261641:  timer_cancel   timer=0xffffff80444f0428\\n\\n[2]\\n\\n 9436.261653][    C4] Unable to handle kernel paging request at virtual address dead00000000012a\\n[ 9436.261664][    C4] Mem abort info:\\n[ 9436.261666][    C4]   ESR = 0x96000044\\n[ 9436.261669][    C4]   EC = 0x25: DABT (current EL), IL = 32 bits\\n[ 9436.261671][    C4]   SET = 0, FnV = 0\\n[ 9436.261673][    C4]   EA = 0, S1PTW = 0\\n[ 9436.261675][    C4] Data abort info:\\n[ 9436.261677][    C4]   ISV = 0, ISS = 0x00000044\\n[ 9436.261680][    C4]   CM = 0, WnR = 1\\n[ 9436.261682][    C4] [dead00000000012a] address between user and kernel address ranges\\n[ 9436.261685][    C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP\\n[ 9436.261701][    C4] Skip md ftrace buffer dump for: 0x3a982d0\\n...\\n\\n[ 9436.262138][    C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S      W  O      5.10.149-android12-9-o-g17f915d29d0c #1\\n[ 9436.262141][    C4] Hardware name: Qualcomm Technologies, Inc.  (DT)\\n[ 9436.262144][    C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--)\\n[ 9436.262161][    C4] pc : expire_timers+0x9c/0x438\\n[ 9436.262164][    C4] lr : expire_timers+0x2a4/0x438\\n[ 9436.262168][    C4] sp : ffffffc010023dd0\\n[ 9436.262171][    C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18\\n[ 9436.262178][    C4] x27: ffffffd063569dd0 x26: ffffffd063536008\\n[ 9436.262182][    C4] x25: 0000000000000001 x24: ffffff88f7c69280\\n[ 9436.262185][    C4] x23: 00000000000000e0 x22: dead000000000122\\n[ 9436.262188][    C4] x21: 000000010022da29 x20: ffffff8af72b4e80\\n[ 9436.262191][    C4] x19: ffffffc010023e50 x18: ffffffc010025038\\n[ 9436.262195][    C4] x17: 0000000000000240 x16: 0000000000000201\\n[ 9436.262199][    C4] x15: ffffffffffffffff x14: ffffff889f3c3100\\n[ 9436.262203][    C4] x13: ffffff889f3c3100 x12: 00000000049f56b8\\n[ 9436.262207][    C4] x11: 00000000049f56b8 x10: 00000000ffffffff\\n[ 9436.262212][    C4] x9 : ffffffc010023e50 x8 : dead000000000122\\n[ 9436.262216][    C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8\\n[ 9436.262220][    C4] x5 : 0000000000000000 x4 : 0000000000000101\\n[ 9436.262223][    C4] x3 : 0000000000000080 x2 : ffffff8\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: PM / devfreq: Sincronizar devfreq_monitor_[start/stop] Existe la posibilidad de que un cambio frecuente del gobernador realizado en un bucle provoque corrupci\u00f3n en la lista de temporizadores, donde la cancelaci\u00f3n del temporizador se realiza desde dos coloque uno de cancel_delayed_work_sync() y seguido de expire_timers() se puede ver en los rastros [1]. mientras que es verdadero, haga echo \\\"simple_ondemand\\\" \u0026gt; /sys/class/devfreq/1d84000.ufshc/governor echo \\\"rendimiento\\\" \u0026gt; /sys/class/devfreq/1d84000.ufshc/governor done Parece ser un problema con el controlador devfreq donde device_monitor_[start /stop] debe sincronizarse para que el trabajo retrasado se corrompa mientras est\u00e1 en cola, ejecut\u00e1ndose o cancel\u00e1ndose. Usemos el indicador de sondeo y el bloqueo devfreq para sincronizar la cola de la instancia del temporizador dos veces y los datos de trabajo que se corrompen. [1] ... .. -0 [003] 9436.209662: timer_cancel timer=0xffffff80444f0428 -0 [003] 9436.209664: timer_expire_entry timer=0xffffff80444f0428 now=0x10022da1c function=__typeid__ZTS FvP10timer_listE_global_addr baseclk=0x10022da1c -0 [003] 9436.209718: timer_expire_exit timer=0xffffff80444f0428 kworker/u16:6-14217 [003] 9436.209863: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expira = 0x10022da2b ahora = 0x10022da1c banderas = 182452227 proveedor.xxxyyy.ha-1593 [004] 9436.209888: timer_cancel temporizador=0xffffff80444f0428 proveedor.xxxyyy.ha-1593 [004] 9436.216390: timer_init temporizador=0xffffff80444f0428 proveedor.xxxyyy.ha-1593 [004] 9436.216392: timer_start temporizador=0xffffff80444f042 8 funci\u00f3n=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2c ahora=0x10022da1d flags=186646532 proveedor.xxxyyy .ha-1593 [005] 9436.220992: timer_cancel timer=0xffffff80444f0428 xxxyyyTraceManag-7795 [004] 9436.261641: timer_cancel timer=0xffffff80444f0428 [2] 9436.261653][ C4] No se puede para manejar la solicitud de paginaci\u00f3n del kernel en la direcci\u00f3n virtual dead00000000012a [ 9436.261664][ C4] Mem informaci\u00f3n de cancelaci\u00f3n: [ 9436.261666][ C4] ESR = 0x96000044 [ 9436.261669][ C4] EC = 0x25: DABT (EL actual), IL = 32 bits [ 9436.261671][ C4] SET = 0, FnV = 0 [ 9436.261673][ C4 ] EA = 0, S1PTW = 0 [ 9436.261675][ C4] Informaci\u00f3n de cancelaci\u00f3n de datos: [ 9436.261677][ C4] ISV = 0, ISS = 0x00000044 [ 9436.261680][ C4] CM = 0, WnR = 1 [ 9436.261682][ C4] [dead00000000012a] direcci\u00f3n entre los rangos de direcciones del usuario y del kernel [ 9436.261685][ C4] Error interno: Vaya: 96000044 [#1] SMP PREEMPT [ 9436.261701][ C4] Omitir el volcado del b\u00fafer md ftrace para: 0x3a982d0 ... [ 9436.262138][ C4 ] CPU: 4 PID: 7795 Comunicaciones: TraceManag Tainted: GSWO 5.10.149-android12-9-o-g17f915d29d0c #1 [ 9436.262141][ C4] Nombre de hardware: Qualcomm Technologies, Inc. (DT) [ 9436.262144][ C4] pstate : 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--) [ 9436.262161][ C4] pc : expire_timers+0x9c/0x438 [ 9436.262164][ C4] lr : expire_timers+0x2a4/0x438 [ 9436.262168][ C4] sp : ffffffc010023dd0 [ 9436.262171][ C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18 [ 9436.262178][ C4] x27: ffffffd063569dd0 x26: ffffffd063536008 [ 9436 .262182][ C4] x25: 0000000000000001 x24: ffffff88f7c69280 [ 9436.262185][ C4] x23: 00000000000000e0 x22: muerto000000000122 [ 9436.262188][ C4] x21: 000000010022da29 x20: ffffff8af72b4e80 [ 9436.262191][ C4] x19: ffffffc010023e50 x18: ffffffc010025038 [ 9436.262195][ C4] x 17: 0000000000000240 x16: 0000000000000201 [ 9436.262199][ C4] x15: ffffffffffffffff x14: ffffff889f3c3100 [ 9436.262203] [ C4] x13: ffffff889f3c3100 x12: 00000000049f56b8 [ 9436.262207][ C4] x11: 00000000049f56b8 x10: 00000000ffffffff [ 9436.262212][ C4] x9 : ffffffc0 10023e50 x8: muerto000000000122 [9436.262216][C4] x7: ffffffffffffffff x6: ffffffc0100239d8 [9436.262220][C4 ]---truncado---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-835\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.10.210\",\"matchCriteriaId\":\"24443040-F8E0-445D-8395-40A94214526C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.149\",\"matchCriteriaId\":\"0D0465BB-4053-4E15-9137-6696EBAE90FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.77\",\"matchCriteriaId\":\"0FA28946-970D-4F4D-B759-4E77B28809B5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.16\",\"matchCriteriaId\":\"A5007D6A-4B58-423A-8A3A-A1A656A263C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.4\",\"matchCriteriaId\":\"848BC44C-9D25-4557-A50A-4B8BF310FA78\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/099f6a9edbe30b142c1d97fe9a4748601d995675\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0aedb319ef3ed39e9e5a7b7726c8264ca627bbd9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/31569995fc65007b73a3fff605ec2b3401b435e9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3399cc7013e761fee9d6eec795e9b31ab0cbe475\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ae815e2fdc284ab31651d52460698bd89c0fce22\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/099f6a9edbe30b142c1d97fe9a4748601d995675\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0aedb319ef3ed39e9e5a7b7726c8264ca627bbd9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/31569995fc65007b73a3fff605ec2b3401b435e9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3399cc7013e761fee9d6eec795e9b31ab0cbe475\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ae815e2fdc284ab31651d52460698bd89c0fce22\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3399cc7013e761fee9d6eec795e9b31ab0cbe475\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/099f6a9edbe30b142c1d97fe9a4748601d995675\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/31569995fc65007b73a3fff605ec2b3401b435e9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0aedb319ef3ed39e9e5a7b7726c8264ca627bbd9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ae815e2fdc284ab31651d52460698bd89c0fce22\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:03:21.345Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52635\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-17T19:30:55.797428Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-17T19:31:00.537Z\"}}], \"cna\": {\"title\": \"PM / devfreq: Synchronize devfreq_monitor_[start/stop]\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7e6fdd4bad033fa2d73716377b184fa975b0d985\", \"lessThan\": \"3399cc7013e761fee9d6eec795e9b31ab0cbe475\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7e6fdd4bad033fa2d73716377b184fa975b0d985\", \"lessThan\": \"099f6a9edbe30b142c1d97fe9a4748601d995675\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7e6fdd4bad033fa2d73716377b184fa975b0d985\", \"lessThan\": \"31569995fc65007b73a3fff605ec2b3401b435e9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7e6fdd4bad033fa2d73716377b184fa975b0d985\", \"lessThan\": \"0aedb319ef3ed39e9e5a7b7726c8264ca627bbd9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7e6fdd4bad033fa2d73716377b184fa975b0d985\", \"lessThan\": \"ae815e2fdc284ab31651d52460698bd89c0fce22\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7e6fdd4bad033fa2d73716377b184fa975b0d985\", \"lessThan\": \"aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/devfreq/devfreq.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.210\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.149\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.77\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.16\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/devfreq/devfreq.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3399cc7013e761fee9d6eec795e9b31ab0cbe475\"}, {\"url\": \"https://git.kernel.org/stable/c/099f6a9edbe30b142c1d97fe9a4748601d995675\"}, {\"url\": \"https://git.kernel.org/stable/c/31569995fc65007b73a3fff605ec2b3401b435e9\"}, {\"url\": \"https://git.kernel.org/stable/c/0aedb319ef3ed39e9e5a7b7726c8264ca627bbd9\"}, {\"url\": \"https://git.kernel.org/stable/c/ae815e2fdc284ab31651d52460698bd89c0fce22\"}, {\"url\": \"https://git.kernel.org/stable/c/aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nPM / devfreq: Synchronize devfreq_monitor_[start/stop]\\n\\nThere is a chance if a frequent switch of the governor\\ndone in a loop result in timer list corruption where\\ntimer cancel being done from two place one from\\ncancel_delayed_work_sync() and followed by expire_timers()\\ncan be seen from the traces[1].\\n\\nwhile true\\ndo\\n        echo \\\"simple_ondemand\\\" \u003e /sys/class/devfreq/1d84000.ufshc/governor\\n        echo \\\"performance\\\" \u003e /sys/class/devfreq/1d84000.ufshc/governor\\ndone\\n\\nIt looks to be issue with devfreq driver where\\ndevice_monitor_[start/stop] need to synchronized so that\\ndelayed work should get corrupted while it is either\\nbeing queued or running or being cancelled.\\n\\nLet\u0027s use polling flag and devfreq lock to synchronize the\\nqueueing the timer instance twice and work data being\\ncorrupted.\\n\\n[1]\\n...\\n..\\n\u003cidle\u003e-0    [003]   9436.209662:  timer_cancel   timer=0xffffff80444f0428\\n\u003cidle\u003e-0    [003]   9436.209664:  timer_expire_entry   timer=0xffffff80444f0428  now=0x10022da1c  function=__typeid__ZTSFvP10timer_listE_global_addr  baseclk=0x10022da1c\\n\u003cidle\u003e-0    [003]   9436.209718:  timer_expire_exit   timer=0xffffff80444f0428\\nkworker/u16:6-14217    [003]   9436.209863:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2b  now=0x10022da1c  flags=182452227\\nvendor.xxxyyy.ha-1593    [004]   9436.209888:  timer_cancel   timer=0xffffff80444f0428\\nvendor.xxxyyy.ha-1593    [004]   9436.216390:  timer_init   timer=0xffffff80444f0428\\nvendor.xxxyyy.ha-1593    [004]   9436.216392:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2c  now=0x10022da1d  flags=186646532\\nvendor.xxxyyy.ha-1593    [005]   9436.220992:  timer_cancel   timer=0xffffff80444f0428\\nxxxyyyTraceManag-7795    [004]   9436.261641:  timer_cancel   timer=0xffffff80444f0428\\n\\n[2]\\n\\n 9436.261653][    C4] Unable to handle kernel paging request at virtual address dead00000000012a\\n[ 9436.261664][    C4] Mem abort info:\\n[ 9436.261666][    C4]   ESR = 0x96000044\\n[ 9436.261669][    C4]   EC = 0x25: DABT (current EL), IL = 32 bits\\n[ 9436.261671][    C4]   SET = 0, FnV = 0\\n[ 9436.261673][    C4]   EA = 0, S1PTW = 0\\n[ 9436.261675][    C4] Data abort info:\\n[ 9436.261677][    C4]   ISV = 0, ISS = 0x00000044\\n[ 9436.261680][    C4]   CM = 0, WnR = 1\\n[ 9436.261682][    C4] [dead00000000012a] address between user and kernel address ranges\\n[ 9436.261685][    C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP\\n[ 9436.261701][    C4] Skip md ftrace buffer dump for: 0x3a982d0\\n...\\n\\n[ 9436.262138][    C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S      W  O      5.10.149-android12-9-o-g17f915d29d0c #1\\n[ 9436.262141][    C4] Hardware name: Qualcomm Technologies, Inc.  (DT)\\n[ 9436.262144][    C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--)\\n[ 9436.262161][    C4] pc : expire_timers+0x9c/0x438\\n[ 9436.262164][    C4] lr : expire_timers+0x2a4/0x438\\n[ 9436.262168][    C4] sp : ffffffc010023dd0\\n[ 9436.262171][    C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18\\n[ 9436.262178][    C4] x27: ffffffd063569dd0 x26: ffffffd063536008\\n[ 9436.262182][    C4] x25: 0000000000000001 x24: ffffff88f7c69280\\n[ 9436.262185][    C4] x23: 00000000000000e0 x22: dead000000000122\\n[ 9436.262188][    C4] x21: 000000010022da29 x20: ffffff8af72b4e80\\n[ 9436.262191][    C4] x19: ffffffc010023e50 x18: ffffffc010025038\\n[ 9436.262195][    C4] x17: 0000000000000240 x16: 0000000000000201\\n[ 9436.262199][    C4] x15: ffffffffffffffff x14: ffffff889f3c3100\\n[ 9436.262203][    C4] x13: ffffff889f3c3100 x12: 00000000049f56b8\\n[ 9436.262207][    C4] x11: 00000000049f56b8 x10: 00000000ffffffff\\n[ 9436.262212][    C4] x9 : ffffffc010023e50 x8 : dead000000000122\\n[ 9436.262216][    C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8\\n[ 9436.262220][    C4] x5 : 0000000000000000 x4 : 0000000000000101\\n[ 9436.262223][    C4] x3 : 0000000000000080 x2 : ffffff8\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.210\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.149\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.77\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.16\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.4\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"3.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-01-05T10:16:54.334Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52635\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-05T10:16:54.334Z\", \"dateReserved\": \"2024-03-06T09:52:12.092Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-02T06:49:13.143Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.