cve-2023-52679
Vulnerability from cvelistv5
Published
2024-05-17 14:24
Modified
2024-08-02 23:11
Severity
Summary
of: Fix double free in of_parse_phandle_with_args_map
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-52679",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-20T14:12:32.015310Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:23:37.773Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:11:34.539Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/26b4d702c44f9e5cf3c5c001ae619a4a001889db"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/a0a061151a6200c13149dbcdb6c065203c8425d2"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/d5f490343c77e6708b6c4aa7dbbfbcbb9546adea"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/4541004084527ce9e95a818ebbc4e6b293ffca21"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/b9d760dae5b10e73369b769073525acd7b3be2bd"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/b64d09a4e8596f76d27f4b4a90a1cf6baf6a82f8"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/cafa992134124e785609a406da4ff2b54052aff7"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/4dde83569832f9377362e50f7748463340c5db6b"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/of/base.c",
"drivers/of/unittest-data/tests-phandle.dtsi",
"drivers/of/unittest.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "26b4d702c44f",
"status": "affected",
"version": "bd6f2fd5a1d5",
"versionType": "git"
},
{
"lessThan": "a0a061151a62",
"status": "affected",
"version": "bd6f2fd5a1d5",
"versionType": "git"
},
{
"lessThan": "d5f490343c77",
"status": "affected",
"version": "bd6f2fd5a1d5",
"versionType": "git"
},
{
"lessThan": "454100408452",
"status": "affected",
"version": "bd6f2fd5a1d5",
"versionType": "git"
},
{
"lessThan": "b9d760dae5b1",
"status": "affected",
"version": "bd6f2fd5a1d5",
"versionType": "git"
},
{
"lessThan": "b64d09a4e859",
"status": "affected",
"version": "bd6f2fd5a1d5",
"versionType": "git"
},
{
"lessThan": "cafa99213412",
"status": "affected",
"version": "bd6f2fd5a1d5",
"versionType": "git"
},
{
"lessThan": "4dde83569832",
"status": "affected",
"version": "bd6f2fd5a1d5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/of/base.c",
"drivers/of/unittest-data/tests-phandle.dtsi",
"drivers/of/unittest.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.306",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.268",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.209",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.148",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.75",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.14",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.7.*",
"status": "unaffected",
"version": "6.7.2",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.8",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nof: Fix double free in of_parse_phandle_with_args_map\n\nIn of_parse_phandle_with_args_map() the inner loop that\niterates through the map entries calls of_node_put(new)\nto free the reference acquired by the previous iteration\nof the inner loop. This assumes that the value of \"new\" is\nNULL on the first iteration of the inner loop.\n\nMake sure that this is true in all iterations of the outer\nloop by setting \"new\" to NULL after its value is assigned to \"cur\".\n\nExtend the unittest to detect the double free and add an additional\ntest case that actually triggers this path."
}
],
"providerMetadata": {
"dateUpdated": "2024-05-29T05:15:45.717Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/26b4d702c44f9e5cf3c5c001ae619a4a001889db"
},
{
"url": "https://git.kernel.org/stable/c/a0a061151a6200c13149dbcdb6c065203c8425d2"
},
{
"url": "https://git.kernel.org/stable/c/d5f490343c77e6708b6c4aa7dbbfbcbb9546adea"
},
{
"url": "https://git.kernel.org/stable/c/4541004084527ce9e95a818ebbc4e6b293ffca21"
},
{
"url": "https://git.kernel.org/stable/c/b9d760dae5b10e73369b769073525acd7b3be2bd"
},
{
"url": "https://git.kernel.org/stable/c/b64d09a4e8596f76d27f4b4a90a1cf6baf6a82f8"
},
{
"url": "https://git.kernel.org/stable/c/cafa992134124e785609a406da4ff2b54052aff7"
},
{
"url": "https://git.kernel.org/stable/c/4dde83569832f9377362e50f7748463340c5db6b"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
}
],
"title": "of: Fix double free in of_parse_phandle_with_args_map",
"x_generator": {
"engine": "bippy-a5840b7849dd"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-52679",
"datePublished": "2024-05-17T14:24:43.380Z",
"dateReserved": "2024-03-07T14:49:46.887Z",
"dateUpdated": "2024-08-02T23:11:34.539Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2023-52679\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T15:15:19.207\",\"lastModified\":\"2024-06-27T12:15:16.100\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nof: Fix double free in of_parse_phandle_with_args_map\\n\\nIn of_parse_phandle_with_args_map() the inner loop that\\niterates through the map entries calls of_node_put(new)\\nto free the reference acquired by the previous iteration\\nof the inner loop. This assumes that the value of \\\"new\\\" is\\nNULL on the first iteration of the inner loop.\\n\\nMake sure that this is true in all iterations of the outer\\nloop by setting \\\"new\\\" to NULL after its value is assigned to \\\"cur\\\".\\n\\nExtend the unittest to detect the double free and add an additional\\ntest case that actually triggers this path.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: of: Solucionado double free en of_parse_phandle_with_args_map En of_parse_phandle_with_args_map() el bucle interno que itera por las entradas del mapa llama a of_node_put(new) para liberar la referencia adquirida por la iteraci\u00f3n anterior del bucle interno . Esto supone que el valor de \\\"nuevo\\\" es NULL en la primera iteraci\u00f3n del bucle interno. Aseg\u00farese de que esto sea cierto en todas las iteraciones del bucle externo estableciendo \\\"nuevo\\\" en NULL despu\u00e9s de que su valor se asigne a \\\"cur\\\". Ampl\u00ede la prueba unitaria para detectar el doble free y agregue un caso de prueba adicional que realmente active esta ruta.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/26b4d702c44f9e5cf3c5c001ae619a4a001889db\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4541004084527ce9e95a818ebbc4e6b293ffca21\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4dde83569832f9377362e50f7748463340c5db6b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a0a061151a6200c13149dbcdb6c065203c8425d2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b64d09a4e8596f76d27f4b4a90a1cf6baf6a82f8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b9d760dae5b10e73369b769073525acd7b3be2bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cafa992134124e785609a406da4ff2b54052aff7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d5f490343c77e6708b6c4aa7dbbfbcbb9546adea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}