GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-52854 (GCVE-0-2023-52854)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:31 – Updated: 2026-05-23 15:27
VLAI
Title
padata: Fix refcnt handling in padata_free_shell()
Summary
In the Linux kernel, the following vulnerability has been resolved: padata: Fix refcnt handling in padata_free_shell() In a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead to system UAF (Use-After-Free) issues. Due to the lengthy analysis of the pcrypt_aead01 function call, I'll describe the problem scenario using a simplified model: Suppose there's a user of padata named `user_function` that adheres to the padata requirement of calling `padata_free_shell` after `serial()` has been invoked, as demonstrated in the following code: ```c struct request { struct padata_priv padata; struct completion *done; }; void parallel(struct padata_priv *padata) { do_something(); } void serial(struct padata_priv *padata) { struct request *request = container_of(padata, struct request, padata); complete(request->done); } void user_function() { DECLARE_COMPLETION(done) padata->parallel = parallel; padata->serial = serial; padata_do_parallel(); wait_for_completion(&done); padata_free_shell(); } ``` In the corresponding padata.c file, there's the following code: ```c static void padata_serial_worker(struct work_struct *serial_work) { ... cnt = 0; while (!list_empty(&local_list)) { ... padata->serial(padata); cnt++; } local_bh_enable(); if (refcount_sub_and_test(cnt, &pd->refcnt)) padata_free_pd(pd); } ``` Because of the high system load and the accumulation of unexecuted softirq at this moment, `local_bh_enable()` in padata takes longer to execute than usual. Subsequently, when accessing `pd->refcnt`, `pd` has already been released by `padata_free_shell()`, resulting in a UAF issue with `pd->refcnt`. The fix is straightforward: add `refcount_dec_and_test` before calling `padata_free_pd` in `padata_free_shell`.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-22 18:22 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 07928d9bfc81640bab36f5190e8725894d93b659 , < 41aad9d6953984d134fc50f631f24ef476875d4d (git)
Affected: 07928d9bfc81640bab36f5190e8725894d93b659 , < 0dd34a7ad395dbcf6ae60e48e9786050e25b9bc5 (git)
Affected: 07928d9bfc81640bab36f5190e8725894d93b659 , < c7c26d0ef5d20f00dbb2ae3befcabbe0efa77275 (git)
Affected: 07928d9bfc81640bab36f5190e8725894d93b659 , < 1e901bcb8af19416b65f5063a4af7996e5a51d7f (git)
Affected: 07928d9bfc81640bab36f5190e8725894d93b659 , < 1734a79e951914f1db2c65e635012a35db1c674b (git)
Affected: 07928d9bfc81640bab36f5190e8725894d93b659 , < 7ddc21e317b360c3444de3023bcc83b85fabae2f (git)
Affected: 13721e447acc2b82c19cf72e9e6c4291c77693ed (git)
Affected: 7a2ccb65f90168edc2348495bb56093c466ffa39 (git)
Affected: 928cf3d733c4efc221e1a78b14cb2ee066627260 (git)
Affected: c9da8ee1491719001a444f4af688b75e72b58418 (git)
Affected: dc34710a7aba5207e7cb99d11588c04535b3c53d (git)
Affected: 5fefc9b3e3584a1ce98da27c38e1b8dda1939d74 (git)
Affected: 26daf8e6515c2dcd25d235468420b9f46e0acdac (git)
Affected: 3.16.84 , < 3.17 (semver)
Affected: 4.4.215 , < 4.5 (semver)
Affected: 4.9.215 , < 4.10 (semver)
Affected: 4.14.172 , < 4.15 (semver)
Affected: 4.19.103 , < 4.20 (semver)
Affected: 5.4.19 , < 5.5 (semver)
Affected: 5.5.3 , < 5.6 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.6
Unaffected: 0 , < 5.6 (semver)
Unaffected: 5.10.201 , ≤ 5.10.* (semver)
Unaffected: 5.15.139 , ≤ 5.15.* (semver)
Unaffected: 6.1.63 , ≤ 6.1.* (semver)
Unaffected: 6.5.12 , ≤ 6.5.* (semver)
Unaffected: 6.6.2 , ≤ 6.6.* (semver)
Unaffected: 6.7 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52854",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-22T18:22:41.019729Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:23:36.501Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:36.064Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/41aad9d6953984d134fc50f631f24ef476875d4d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0dd34a7ad395dbcf6ae60e48e9786050e25b9bc5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c7c26d0ef5d20f00dbb2ae3befcabbe0efa77275"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1e901bcb8af19416b65f5063a4af7996e5a51d7f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1734a79e951914f1db2c65e635012a35db1c674b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7ddc21e317b360c3444de3023bcc83b85fabae2f"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/padata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "41aad9d6953984d134fc50f631f24ef476875d4d",
              "status": "affected",
              "version": "07928d9bfc81640bab36f5190e8725894d93b659",
              "versionType": "git"
            },
            {
              "lessThan": "0dd34a7ad395dbcf6ae60e48e9786050e25b9bc5",
              "status": "affected",
              "version": "07928d9bfc81640bab36f5190e8725894d93b659",
              "versionType": "git"
            },
            {
              "lessThan": "c7c26d0ef5d20f00dbb2ae3befcabbe0efa77275",
              "status": "affected",
              "version": "07928d9bfc81640bab36f5190e8725894d93b659",
              "versionType": "git"
            },
            {
              "lessThan": "1e901bcb8af19416b65f5063a4af7996e5a51d7f",
              "status": "affected",
              "version": "07928d9bfc81640bab36f5190e8725894d93b659",
              "versionType": "git"
            },
            {
              "lessThan": "1734a79e951914f1db2c65e635012a35db1c674b",
              "status": "affected",
              "version": "07928d9bfc81640bab36f5190e8725894d93b659",
              "versionType": "git"
            },
            {
              "lessThan": "7ddc21e317b360c3444de3023bcc83b85fabae2f",
              "status": "affected",
              "version": "07928d9bfc81640bab36f5190e8725894d93b659",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "13721e447acc2b82c19cf72e9e6c4291c77693ed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7a2ccb65f90168edc2348495bb56093c466ffa39",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "928cf3d733c4efc221e1a78b14cb2ee066627260",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c9da8ee1491719001a444f4af688b75e72b58418",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dc34710a7aba5207e7cb99d11588c04535b3c53d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5fefc9b3e3584a1ce98da27c38e1b8dda1939d74",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "26daf8e6515c2dcd25d235468420b9f46e0acdac",
              "versionType": "git"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.84",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.215",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.215",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.172",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.103",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.19",
              "versionType": "semver"
            },
            {
              "lessThan": "5.6",
              "status": "affected",
              "version": "5.5.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/padata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.201",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.139",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.7",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.201",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.139",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.63",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.12",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.2",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.84",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.215",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.215",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.172",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.103",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: Fix refcnt handling in padata_free_shell()\n\nIn a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead\nto system UAF (Use-After-Free) issues. Due to the lengthy analysis of\nthe pcrypt_aead01 function call, I\u0027ll describe the problem scenario\nusing a simplified model:\n\nSuppose there\u0027s a user of padata named `user_function` that adheres to\nthe padata requirement of calling `padata_free_shell` after `serial()`\nhas been invoked, as demonstrated in the following code:\n\n```c\nstruct request {\n    struct padata_priv padata;\n    struct completion *done;\n};\n\nvoid parallel(struct padata_priv *padata) {\n    do_something();\n}\n\nvoid serial(struct padata_priv *padata) {\n    struct request *request = container_of(padata,\n    \t\t\t\tstruct request,\n\t\t\t\tpadata);\n    complete(request-\u003edone);\n}\n\nvoid user_function() {\n    DECLARE_COMPLETION(done)\n    padata-\u003eparallel = parallel;\n    padata-\u003eserial = serial;\n    padata_do_parallel();\n    wait_for_completion(\u0026done);\n    padata_free_shell();\n}\n```\n\nIn the corresponding padata.c file, there\u0027s the following code:\n\n```c\nstatic void padata_serial_worker(struct work_struct *serial_work) {\n    ...\n    cnt = 0;\n\n    while (!list_empty(\u0026local_list)) {\n        ...\n        padata-\u003eserial(padata);\n        cnt++;\n    }\n\n    local_bh_enable();\n\n    if (refcount_sub_and_test(cnt, \u0026pd-\u003erefcnt))\n        padata_free_pd(pd);\n}\n```\n\nBecause of the high system load and the accumulation of unexecuted\nsoftirq at this moment, `local_bh_enable()` in padata takes longer\nto execute than usual. Subsequently, when accessing `pd-\u003erefcnt`,\n`pd` has already been released by `padata_free_shell()`, resulting\nin a UAF issue with `pd-\u003erefcnt`.\n\nThe fix is straightforward: add `refcount_dec_and_test` before calling\n`padata_free_pd` in `padata_free_shell`."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:27:22.967Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/41aad9d6953984d134fc50f631f24ef476875d4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dd34a7ad395dbcf6ae60e48e9786050e25b9bc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7c26d0ef5d20f00dbb2ae3befcabbe0efa77275"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e901bcb8af19416b65f5063a4af7996e5a51d7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1734a79e951914f1db2c65e635012a35db1c674b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ddc21e317b360c3444de3023bcc83b85fabae2f"
        }
      ],
      "title": "padata: Fix refcnt handling in padata_free_shell()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52854",
    "datePublished": "2024-05-21T15:31:49.235Z",
    "dateReserved": "2024-05-21T15:19:24.256Z",
    "dateUpdated": "2026-05-23T15:27:22.967Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52854",
      "date": "2026-09-16",
      "epss": "0.00242",
      "percentile": "0.15591"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\npadata: Fix refcnt handling in padata_free_shell()\\n\\nIn a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead\\nto system UAF (Use-After-Free) issues. Due to the lengthy analysis of\\nthe pcrypt_aead01 function call, I\u0027ll describe the problem scenario\\nusing a simplified model:\\n\\nSuppose there\u0027s a user of padata named `user_function` that adheres to\\nthe padata requirement of calling `padata_free_shell` after `serial()`\\nhas been invoked, as demonstrated in the following code:\\n\\n```c\\nstruct request {\\n    struct padata_priv padata;\\n    struct completion *done;\\n};\\n\\nvoid parallel(struct padata_priv *padata) {\\n    do_something();\\n}\\n\\nvoid serial(struct padata_priv *padata) {\\n    struct request *request = container_of(padata,\\n    \\t\\t\\t\\tstruct request,\\n\\t\\t\\t\\tpadata);\\n    complete(request-\u003edone);\\n}\\n\\nvoid user_function() {\\n    DECLARE_COMPLETION(done)\\n    padata-\u003eparallel = parallel;\\n    padata-\u003eserial = serial;\\n    padata_do_parallel();\\n    wait_for_completion(\u0026done);\\n    padata_free_shell();\\n}\\n```\\n\\nIn the corresponding padata.c file, there\u0027s the following code:\\n\\n```c\\nstatic void padata_serial_worker(struct work_struct *serial_work) {\\n    ...\\n    cnt = 0;\\n\\n    while (!list_empty(\u0026local_list)) {\\n        ...\\n        padata-\u003eserial(padata);\\n        cnt++;\\n    }\\n\\n    local_bh_enable();\\n\\n    if (refcount_sub_and_test(cnt, \u0026pd-\u003erefcnt))\\n        padata_free_pd(pd);\\n}\\n```\\n\\nBecause of the high system load and the accumulation of unexecuted\\nsoftirq at this moment, `local_bh_enable()` in padata takes longer\\nto execute than usual. Subsequently, when accessing `pd-\u003erefcnt`,\\n`pd` has already been released by `padata_free_shell()`, resulting\\nin a UAF issue with `pd-\u003erefcnt`.\\n\\nThe fix is straightforward: add `refcount_dec_and_test` before calling\\n`padata_free_pd` in `padata_free_shell`.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: padata: corrige el manejo de refcnt en padata_free_shell(). En un entorno arm64 de alta carga, la prueba pcrypt_aead01 en LTP puede provocar problemas de UAF (Use-After-Free) del sistema. Debido al extenso an\\u00e1lisis de la llamada a la funci\\u00f3n pcrypt_aead01, describir\\u00e9 el escenario del problema usando un modelo simplificado: supongamos que hay un usuario de padata llamado `user_function` que cumple con el requisito de padata de llamar a `padata_free_shell` despu\\u00e9s de `serial()`. ha sido invocado, como se demuestra en el siguiente c\\u00f3digo: ```c struct request { struct padata_priv padata; finalizaci\\u00f3n de la estructura *hecho; }; void paralelo(struct padata_priv *padata) { hacer_algo(); } void serial(struct padata_priv *padata) { solicitud de estructura *request = container_of(padata, solicitud de estructura, padata); completar(solicitud-\u0026gt;hecho); } void user_function() { DECLARE_COMPLETION(hecho) padata-\u0026gt;parallel = parallel; padata-\u0026gt;serial = serial; padata_do_parallel(); wait_for_completion(\u0026amp;hecho); padata_free_shell(); } ``` En el archivo padata.c correspondiente, hay el siguiente c\\u00f3digo: ```c static void padata_serial_worker(struct work_struct *serial_work) { ... cnt = 0; while (!list_empty(\u0026amp;local_list)) { ... padata-\u0026gt;serial(padata); cnt++; } local_bh_enable(); if (refcount_sub_and_test(cnt, \u0026amp;pd-\u0026gt;refcnt)) padata_free_pd(pd); } ``` Debido a la alta carga del sistema y la acumulaci\\u00f3n de software no ejecutado en este momento, `local_bh_enable()` en padata tarda m\\u00e1s de lo habitual en ejecutarse. Posteriormente, al acceder a `pd-\u0026gt;refcnt`, `pd` ya ha sido liberado por `padata_free_shell()`, lo que genera un problema de UAF con `pd-\u0026gt;refcnt`. La soluci\\u00f3n es sencilla: agregue `refcount_dec_and_test` antes de llamar a `padata_free_pd` en `padata_free_shell`.\"}]",
      "id": "CVE-2023-52854",
      "lastModified": "2024-11-21T08:40:43.647",
      "published": "2024-05-21T16:15:22.377",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0dd34a7ad395dbcf6ae60e48e9786050e25b9bc5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/1734a79e951914f1db2c65e635012a35db1c674b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/1e901bcb8af19416b65f5063a4af7996e5a51d7f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/41aad9d6953984d134fc50f631f24ef476875d4d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7ddc21e317b360c3444de3023bcc83b85fabae2f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c7c26d0ef5d20f00dbb2ae3befcabbe0efa77275\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/0dd34a7ad395dbcf6ae60e48e9786050e25b9bc5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/1734a79e951914f1db2c65e635012a35db1c674b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/1e901bcb8af19416b65f5063a4af7996e5a51d7f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/41aad9d6953984d134fc50f631f24ef476875d4d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/7ddc21e317b360c3444de3023bcc83b85fabae2f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c7c26d0ef5d20f00dbb2ae3befcabbe0efa77275\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52854\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T16:15:22.377\",\"lastModified\":\"2026-06-17T06:43:44.443\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npadata: Fix refcnt handling in padata_free_shell()\\n\\nIn a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead\\nto system UAF (Use-After-Free) issues. Due to the lengthy analysis of\\nthe pcrypt_aead01 function call, I\u0027ll describe the problem scenario\\nusing a simplified model:\\n\\nSuppose there\u0027s a user of padata named `user_function` that adheres to\\nthe padata requirement of calling `padata_free_shell` after `serial()`\\nhas been invoked, as demonstrated in the following code:\\n\\n```c\\nstruct request {\\n    struct padata_priv padata;\\n    struct completion *done;\\n};\\n\\nvoid parallel(struct padata_priv *padata) {\\n    do_something();\\n}\\n\\nvoid serial(struct padata_priv *padata) {\\n    struct request *request = container_of(padata,\\n    \\t\\t\\t\\tstruct request,\\n\\t\\t\\t\\tpadata);\\n    complete(request-\u003edone);\\n}\\n\\nvoid user_function() {\\n    DECLARE_COMPLETION(done)\\n    padata-\u003eparallel = parallel;\\n    padata-\u003eserial = serial;\\n    padata_do_parallel();\\n    wait_for_completion(\u0026done);\\n    padata_free_shell();\\n}\\n```\\n\\nIn the corresponding padata.c file, there\u0027s the following code:\\n\\n```c\\nstatic void padata_serial_worker(struct work_struct *serial_work) {\\n    ...\\n    cnt = 0;\\n\\n    while (!list_empty(\u0026local_list)) {\\n        ...\\n        padata-\u003eserial(padata);\\n        cnt++;\\n    }\\n\\n    local_bh_enable();\\n\\n    if (refcount_sub_and_test(cnt, \u0026pd-\u003erefcnt))\\n        padata_free_pd(pd);\\n}\\n```\\n\\nBecause of the high system load and the accumulation of unexecuted\\nsoftirq at this moment, `local_bh_enable()` in padata takes longer\\nto execute than usual. Subsequently, when accessing `pd-\u003erefcnt`,\\n`pd` has already been released by `padata_free_shell()`, resulting\\nin a UAF issue with `pd-\u003erefcnt`.\\n\\nThe fix is straightforward: add `refcount_dec_and_test` before calling\\n`padata_free_pd` in `padata_free_shell`.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: padata: corrige el manejo de refcnt en padata_free_shell(). En un entorno arm64 de alta carga, la prueba pcrypt_aead01 en LTP puede provocar problemas de UAF (Use-After-Free) del sistema. Debido al extenso an\u00e1lisis de la llamada a la funci\u00f3n pcrypt_aead01, describir\u00e9 el escenario del problema usando un modelo simplificado: supongamos que hay un usuario de padata llamado `user_function` que cumple con el requisito de padata de llamar a `padata_free_shell` despu\u00e9s de `serial()`. ha sido invocado, como se demuestra en el siguiente c\u00f3digo: ```c struct request { struct padata_priv padata; finalizaci\u00f3n de la estructura *hecho; }; void paralelo(struct padata_priv *padata) { hacer_algo(); } void serial(struct padata_priv *padata) { solicitud de estructura *request = container_of(padata, solicitud de estructura, padata); completar(solicitud-\u0026gt;hecho); } void user_function() { DECLARE_COMPLETION(hecho) padata-\u0026gt;parallel = parallel; padata-\u0026gt;serial = serial; padata_do_parallel(); wait_for_completion(\u0026amp;hecho); padata_free_shell(); } ``` En el archivo padata.c correspondiente, hay el siguiente c\u00f3digo: ```c static void padata_serial_worker(struct work_struct *serial_work) { ... cnt = 0; while (!list_empty(\u0026amp;local_list)) { ... padata-\u0026gt;serial(padata); cnt++; } local_bh_enable(); if (refcount_sub_and_test(cnt, \u0026amp;pd-\u0026gt;refcnt)) padata_free_pd(pd); } ``` Debido a la alta carga del sistema y la acumulaci\u00f3n de software no ejecutado en este momento, `local_bh_enable()` en padata tarda m\u00e1s de lo habitual en ejecutarse. Posteriormente, al acceder a `pd-\u0026gt;refcnt`, `pd` ya ha sido liberado por `padata_free_shell()`, lo que genera un problema de UAF con `pd-\u0026gt;refcnt`. La soluci\u00f3n es sencilla: agregue `refcount_dec_and_test` antes de llamar a `padata_free_pd` en `padata_free_shell`.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/padata.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"07928d9bfc81640bab36f5190e8725894d93b659\",\"lessThan\":\"41aad9d6953984d134fc50f631f24ef476875d4d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"07928d9bfc81640bab36f5190e8725894d93b659\",\"lessThan\":\"0dd34a7ad395dbcf6ae60e48e9786050e25b9bc5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"07928d9bfc81640bab36f5190e8725894d93b659\",\"lessThan\":\"c7c26d0ef5d20f00dbb2ae3befcabbe0efa77275\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"07928d9bfc81640bab36f5190e8725894d93b659\",\"lessThan\":\"1e901bcb8af19416b65f5063a4af7996e5a51d7f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"07928d9bfc81640bab36f5190e8725894d93b659\",\"lessThan\":\"1734a79e951914f1db2c65e635012a35db1c674b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"07928d9bfc81640bab36f5190e8725894d93b659\",\"lessThan\":\"7ddc21e317b360c3444de3023bcc83b85fabae2f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13721e447acc2b82c19cf72e9e6c4291c77693ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7a2ccb65f90168edc2348495bb56093c466ffa39\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"928cf3d733c4efc221e1a78b14cb2ee066627260\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c9da8ee1491719001a444f4af688b75e72b58418\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dc34710a7aba5207e7cb99d11588c04535b3c53d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5fefc9b3e3584a1ce98da27c38e1b8dda1939d74\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"26daf8e6515c2dcd25d235468420b9f46e0acdac\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3.16.84\",\"lessThan\":\"3.17\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.4.215\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.9.215\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.172\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.103\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.19\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.5.3\",\"lessThan\":\"5.6\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/padata.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.201\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.139\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.63\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5.12\",\"lessThanOrEqual\":\"6.5.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.2\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-22T18:22:41.019729Z\",\"id\":\"CVE-2023-52854\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.16.84\",\"versionEndExcluding\":\"3.17\",\"matchCriteriaId\":\"04270E31-70AC-4AF3-9072-2B0D2B4AF674\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.4.215\",\"versionEndExcluding\":\"4.5\",\"matchCriteriaId\":\"2E234F5F-73BF-40B3-8B72-04A9358453C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9.215\",\"versionEndExcluding\":\"4.10\",\"matchCriteriaId\":\"71F6952C-9E92-4DD4-B6A6-4B7BCC874288\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.172\",\"versionEndExcluding\":\"4.15\",\"matchCriteriaId\":\"35D52B0E-248A-42A0-B3C9-78EB65C172A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.103\",\"versionEndExcluding\":\"4.20\",\"matchCriteriaId\":\"9A00E397-9719-4A33-9898-4062ED92C311\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.19\",\"versionEndExcluding\":\"5.5\",\"matchCriteriaId\":\"F8D27E1D-B88C-4DA9-AA0B-5EE142C053FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5.3\",\"versionEndExcluding\":\"5.10.201\",\"matchCriteriaId\":\"AB058081-871A-435F-9925-7F2B13539E02\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.139\",\"matchCriteriaId\":\"81424D14-B38F-47B3-A1B8-BC3B60BB96EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.63\",\"matchCriteriaId\":\"80E1EA7E-2788-466C-9FFB-34AFA1B052F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.5.12\",\"matchCriteriaId\":\"825F64D9-E99F-49AA-8A7B-EF7C2965C5B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.2\",\"matchCriteriaId\":\"4CBFF885-A4D3-4F21-B6FD-4D770034C048\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0dd34a7ad395dbcf6ae60e48e9786050e25b9bc5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1734a79e951914f1db2c65e635012a35db1c674b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1e901bcb8af19416b65f5063a4af7996e5a51d7f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/41aad9d6953984d134fc50f631f24ef476875d4d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7ddc21e317b360c3444de3023bcc83b85fabae2f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c7c26d0ef5d20f00dbb2ae3befcabbe0efa77275\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0dd34a7ad395dbcf6ae60e48e9786050e25b9bc5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1734a79e951914f1db2c65e635012a35db1c674b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1e901bcb8af19416b65f5063a4af7996e5a51d7f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/41aad9d6953984d134fc50f631f24ef476875d4d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7ddc21e317b360c3444de3023bcc83b85fabae2f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c7c26d0ef5d20f00dbb2ae3befcabbe0efa77275\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T13:53:42+00:00",
      "cve": "CVE-2023-52854",
      "id": "CVE-2023-52854",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: padata: Fix refcnt handling in padata_free_shell()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52854.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T01:47:32Z",
      "cve": "CVE-2023-52854",
      "id": "CVE-2023-52854",
      "initial_release_date": "2024-05-29T14:18:59Z",
      "product_status:known_affected": "384",
      "product_status:known_not_affected": "68",
      "product_status:recommended": "934",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-52854",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-52854.json",
      "version": "111"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/41aad9d6953984d134fc50f631f24ef476875d4d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0dd34a7ad395dbcf6ae60e48e9786050e25b9bc5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c7c26d0ef5d20f00dbb2ae3befcabbe0efa77275\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1e901bcb8af19416b65f5063a4af7996e5a51d7f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1734a79e951914f1db2c65e635012a35db1c674b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7ddc21e317b360c3444de3023bcc83b85fabae2f\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:11:36.064Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52854\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-22T18:22:41.019729Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:25.632Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"padata: Fix refcnt handling in padata_free_shell()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"07928d9bfc81\", \"lessThan\": \"41aad9d69539\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"07928d9bfc81\", \"lessThan\": \"0dd34a7ad395\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"07928d9bfc81\", \"lessThan\": \"c7c26d0ef5d2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"07928d9bfc81\", \"lessThan\": \"1e901bcb8af1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"07928d9bfc81\", \"lessThan\": \"1734a79e9519\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"07928d9bfc81\", \"lessThan\": \"7ddc21e317b3\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/padata.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.6\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"5.10.201\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.139\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.63\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.5.12\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.5.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.2\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/padata.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/41aad9d6953984d134fc50f631f24ef476875d4d\"}, {\"url\": \"https://git.kernel.org/stable/c/0dd34a7ad395dbcf6ae60e48e9786050e25b9bc5\"}, {\"url\": \"https://git.kernel.org/stable/c/c7c26d0ef5d20f00dbb2ae3befcabbe0efa77275\"}, {\"url\": \"https://git.kernel.org/stable/c/1e901bcb8af19416b65f5063a4af7996e5a51d7f\"}, {\"url\": \"https://git.kernel.org/stable/c/1734a79e951914f1db2c65e635012a35db1c674b\"}, {\"url\": \"https://git.kernel.org/stable/c/7ddc21e317b360c3444de3023bcc83b85fabae2f\"}], \"x_generator\": {\"engine\": \"bippy-a5840b7849dd\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\npadata: Fix refcnt handling in padata_free_shell()\\n\\nIn a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead\\nto system UAF (Use-After-Free) issues. Due to the lengthy analysis of\\nthe pcrypt_aead01 function call, I\u0027ll describe the problem scenario\\nusing a simplified model:\\n\\nSuppose there\u0027s a user of padata named `user_function` that adheres to\\nthe padata requirement of calling `padata_free_shell` after `serial()`\\nhas been invoked, as demonstrated in the following code:\\n\\n```c\\nstruct request {\\n    struct padata_priv padata;\\n    struct completion *done;\\n};\\n\\nvoid parallel(struct padata_priv *padata) {\\n    do_something();\\n}\\n\\nvoid serial(struct padata_priv *padata) {\\n    struct request *request = container_of(padata,\\n    \\t\\t\\t\\tstruct request,\\n\\t\\t\\t\\tpadata);\\n    complete(request-\u003edone);\\n}\\n\\nvoid user_function() {\\n    DECLARE_COMPLETION(done)\\n    padata-\u003eparallel = parallel;\\n    padata-\u003eserial = serial;\\n    padata_do_parallel();\\n    wait_for_completion(\u0026done);\\n    padata_free_shell();\\n}\\n```\\n\\nIn the corresponding padata.c file, there\u0027s the following code:\\n\\n```c\\nstatic void padata_serial_worker(struct work_struct *serial_work) {\\n    ...\\n    cnt = 0;\\n\\n    while (!list_empty(\u0026local_list)) {\\n        ...\\n        padata-\u003eserial(padata);\\n        cnt++;\\n    }\\n\\n    local_bh_enable();\\n\\n    if (refcount_sub_and_test(cnt, \u0026pd-\u003erefcnt))\\n        padata_free_pd(pd);\\n}\\n```\\n\\nBecause of the high system load and the accumulation of unexecuted\\nsoftirq at this moment, `local_bh_enable()` in padata takes longer\\nto execute than usual. Subsequently, when accessing `pd-\u003erefcnt`,\\n`pd` has already been released by `padata_free_shell()`, resulting\\nin a UAF issue with `pd-\u003erefcnt`.\\n\\nThe fix is straightforward: add `refcount_dec_and_test` before calling\\n`padata_free_pd` in `padata_free_shell`.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-05-29T05:18:30.184Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52854\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T23:11:36.064Z\", \"dateReserved\": \"2024-05-21T15:19:24.256Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T15:31:49.235Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.