Vulnerability-Lookup

GHSA-W9FV-GM94-H938

Vulnerability from github – Published: 2024-05-21 18:31 – Updated: 2025-09-23 21:30

Details

In the Linux kernel, the following vulnerability has been resolved:

fbdev: Fix invalid page access after closing deferred I/O devices

When a fbdev with deferred I/O is once opened and closed, the dirty pages still remain queued in the pageref list, and eventually later those may be processed in the delayed work. This may lead to a corruption of pages, hitting an Oops.

This patch makes sure to cancel the delayed work and clean up the pageref list at closing the device for addressing the bug. A part of the cleanup code is factored out as a new helper function that is called from the common fb_release().

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-52731"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-21T16:15:13Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Fix invalid page access after closing deferred I/O devices\n\nWhen a fbdev with deferred I/O is once opened and closed, the dirty\npages still remain queued in the pageref list, and eventually later\nthose may be processed in the delayed work.  This may lead to a\ncorruption of pages, hitting an Oops.\n\nThis patch makes sure to cancel the delayed work and clean up the\npageref list at closing the device for addressing the bug.  A part of\nthe cleanup code is factored out as a new helper function that is\ncalled from the common fb_release().",
  "id": "GHSA-w9fv-gm94-h938",
  "modified": "2025-09-23T21:30:53Z",
  "published": "2024-05-21T18:31:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52731"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3efc61d95259956db25347e2a9562c3e54546e20"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/87b9802ca824fcee7915e717e9a60471af62e8e9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f1d91f0e9d5a240a809698d7d9c5a538e7dcc149"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2023-52731 (GCVE-0-2023-52731)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:22 – Updated: 2026-08-05 09:11

Title

fbdev: Fix invalid page access after closing deferred I/O devices

Summary

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix invalid page access after closing deferred I/O devices When a fbdev with deferred I/O is once opened and closed, the dirty pages still remain queued in the pageref list, and eventually later those may be processed in the delayed work. This may lead to a corruption of pages, hitting an Oops. This patch makes sure to cancel the delayed work and clean up the pageref list at closing the device for addressing the bug. A part of the cleanup code is factored out as a new helper function that is called from the common fb_release().

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 15:37 UTC

Assigner

Linux mitre root Scorecard

References

3 references

URL	Tags
https://git.kernel.org/stable/c/87b9802ca824fcee7…
https://git.kernel.org/stable/c/f1d91f0e9d5a240a8…
https://git.kernel.org/stable/c/3efc61d95259956db…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 186b89659c4c67cccead52961eab0ca3b23951dc , < 87b9802ca824fcee7915e717e9a60471af62e8e9 (git) Affected: 56c134f7f1b58be08bdb0ca8372474a4a5165f31 , < f1d91f0e9d5a240a809698d7d9c5a538e7dcc149 (git) Affected: 56c134f7f1b58be08bdb0ca8372474a4a5165f31 , < 3efc61d95259956db25347e2a9562c3e54546e20 (git)
Linux	Linux	Affected: 5.19 Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.13 , ≤ 6.1.* (semver) Unaffected: 6.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:35.499Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/87b9802ca824fcee7915e717e9a60471af62e8e9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f1d91f0e9d5a240a809698d7d9c5a538e7dcc149"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3efc61d95259956db25347e2a9562c3e54546e20"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52731",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:37:38.155499Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:36.311Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fb_defio.c",
            "drivers/video/fbdev/core/fbmem.c",
            "include/linux/fb.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "87b9802ca824fcee7915e717e9a60471af62e8e9",
              "status": "affected",
              "version": "186b89659c4c67cccead52961eab0ca3b23951dc",
              "versionType": "git"
            },
            {
              "lessThan": "f1d91f0e9d5a240a809698d7d9c5a538e7dcc149",
              "status": "affected",
              "version": "56c134f7f1b58be08bdb0ca8372474a4a5165f31",
              "versionType": "git"
            },
            {
              "lessThan": "3efc61d95259956db25347e2a9562c3e54546e20",
              "status": "affected",
              "version": "56c134f7f1b58be08bdb0ca8372474a4a5165f31",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fb_defio.c",
            "drivers/video/fbdev/core/fbmem.c",
            "include/linux/fb.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.13",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Fix invalid page access after closing deferred I/O devices\n\nWhen a fbdev with deferred I/O is once opened and closed, the dirty\npages still remain queued in the pageref list, and eventually later\nthose may be processed in the delayed work.  This may lead to a\ncorruption of pages, hitting an Oops.\n\nThis patch makes sure to cancel the delayed work and clean up the\npageref list at closing the device for addressing the bug.  A part of\nthe cleanup code is factored out as a new helper function that is\ncalled from the common fb_release()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires opening, mmaping, writing, and closing a local framebuffer device node (/dev/fb*), which is a local syscall/device-file attack path rather than network or adjacent-network access.\nAC:L - The attacker fully controls the trigger sequence (mmap write to queue dirty pagerefs and schedule delayed work, then close before the work runs); the deferred-I/O delay is deterministic and requires no conditions outside attacker control.\nPR:L - fb_open/fb_mmap impose no capability checks; access is gated only by /dev/fb* permissions (typically root:video), so an unprivileged video-group or similarly permitted local user can reach the bug without real root.\nUI:N - The attacker performs open/mmap/write/close themselves; no separate victim action is required to trigger the deferred work on the stale pageref list.\nS:U - Impact is confined to the host kernel authority (local privilege escalation / crash); this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Closing leaves dirty pagerefs queued and page-\u003emapping set on framebuffer pages, so later deferred work performs invalid page access and page corruption; such kernel memory corruption can be leveraged for information disclosure.\nI:H - The same stale-pageref / unclean page-\u003emapping path corrupts kernel page state and can be abused for integrity violation or control-flow hijacking, consistent with treating this class of memory corruption as high integrity impact.\nA:H - The commit explicitly documents that processing the leftover pagerefs after close leads to an Oops/kernel crash, which is high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:11:07.269Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/87b9802ca824fcee7915e717e9a60471af62e8e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1d91f0e9d5a240a809698d7d9c5a538e7dcc149"
        },
        {
          "url": "https://git.kernel.org/stable/c/3efc61d95259956db25347e2a9562c3e54546e20"
        }
      ],
      "title": "fbdev: Fix invalid page access after closing deferred I/O devices",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52731",
    "datePublished": "2024-05-21T15:22:57.282Z",
    "dateReserved": "2024-05-21T15:19:24.232Z",
    "dateUpdated": "2026-08-05T09:11:07.269Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-W9FV-GM94-H938

CVE-2023-52731 (GCVE-0-2023-52731)

Tags

Sightings

Nomenclature

Related by attack behaviour