cve-2023-52849
Vulnerability from cvelistv5
Published
2024-05-21 15:31
Modified
2024-12-19 08:27
Severity ?
EPSS score ?
0.09% (0.23009)
Summary
In the Linux kernel, the following vulnerability has been resolved: cxl/mem: Fix shutdown order Ira reports that removing cxl_mock_mem causes a crash with the following trace: BUG: kernel NULL pointer dereference, address: 0000000000000044 [..] RIP: 0010:cxl_region_decode_reset+0x7f/0x180 [cxl_core] [..] Call Trace: <TASK> cxl_region_detach+0xe8/0x210 [cxl_core] cxl_decoder_kill_region+0x27/0x40 [cxl_core] cxld_unregister+0x29/0x40 [cxl_core] devres_release_all+0xb8/0x110 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1d2/0x210 bus_remove_device+0xd7/0x150 device_del+0x155/0x3e0 device_unregister+0x13/0x60 devm_release_action+0x4d/0x90 ? __pfx_unregister_port+0x10/0x10 [cxl_core] delete_endpoint+0x121/0x130 [cxl_core] devres_release_all+0xb8/0x110 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1d2/0x210 bus_remove_device+0xd7/0x150 device_del+0x155/0x3e0 ? lock_release+0x142/0x290 cdev_device_del+0x15/0x50 cxl_memdev_unregister+0x54/0x70 [cxl_core] This crash is due to the clearing out the cxl_memdev's driver context (@cxlds) before the subsystem is done with it. This is ultimately due to the region(s), that this memdev is a member, being torn down and expecting to be able to de-reference @cxlds, like here: static int cxl_region_decode_reset(struct cxl_region *cxlr, int count) ... if (cxlds->rcd) goto endpoint_reset; ... Fix it by keeping the driver context valid until memdev-device unregistration, and subsequently the entire stack of related dependencies, unwinds.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0ca074f7d788627a4e0b047ca5fbdb5fc567220cPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/20bd0198bebdd706bd4614b3933ef70d7c19618fPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7c7371b41a14e86f53e7dbe5baa7b1d3e0ab324bPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/88d3917f82ed4215a2154432c26de1480a61b209Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cad22a757029c3a1985c221a2d4a6491ad4035aePatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/0ca074f7d788627a4e0b047ca5fbdb5fc567220cPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/20bd0198bebdd706bd4614b3933ef70d7c19618fPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/7c7371b41a14e86f53e7dbe5baa7b1d3e0ab324bPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/88d3917f82ed4215a2154432c26de1480a61b209Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/cad22a757029c3a1985c221a2d4a6491ad4035aePatch
Impacted products
Vendor Product Version
Linux Linux Version: 9cc238c7a526dba9ee8c210fa2828886fc65db66
Version: 9cc238c7a526dba9ee8c210fa2828886fc65db66
Version: 9cc238c7a526dba9ee8c210fa2828886fc65db66
Version: 9cc238c7a526dba9ee8c210fa2828886fc65db66
Version: 9cc238c7a526dba9ee8c210fa2828886fc65db66
 Create a notification for this product.
   Linux Linux Version: 5.15
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-52849",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-06-10T19:16:24.136793Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-10T19:16:37.413Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T23:11:35.944Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/20bd0198bebdd706bd4614b3933ef70d7c19618f",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/7c7371b41a14e86f53e7dbe5baa7b1d3e0ab324b",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/cad22a757029c3a1985c221a2d4a6491ad4035ae",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/0ca074f7d788627a4e0b047ca5fbdb5fc567220c",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/88d3917f82ed4215a2154432c26de1480a61b209",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "drivers/cxl/core/memdev.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "20bd0198bebdd706bd4614b3933ef70d7c19618f",
                     status: "affected",
                     version: "9cc238c7a526dba9ee8c210fa2828886fc65db66",
                     versionType: "git",
                  },
                  {
                     lessThan: "7c7371b41a14e86f53e7dbe5baa7b1d3e0ab324b",
                     status: "affected",
                     version: "9cc238c7a526dba9ee8c210fa2828886fc65db66",
                     versionType: "git",
                  },
                  {
                     lessThan: "cad22a757029c3a1985c221a2d4a6491ad4035ae",
                     status: "affected",
                     version: "9cc238c7a526dba9ee8c210fa2828886fc65db66",
                     versionType: "git",
                  },
                  {
                     lessThan: "0ca074f7d788627a4e0b047ca5fbdb5fc567220c",
                     status: "affected",
                     version: "9cc238c7a526dba9ee8c210fa2828886fc65db66",
                     versionType: "git",
                  },
                  {
                     lessThan: "88d3917f82ed4215a2154432c26de1480a61b209",
                     status: "affected",
                     version: "9cc238c7a526dba9ee8c210fa2828886fc65db66",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "drivers/cxl/core/memdev.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "5.15",
                  },
                  {
                     lessThan: "5.15",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.15.*",
                     status: "unaffected",
                     version: "5.15.139",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.1.*",
                     status: "unaffected",
                     version: "6.1.63",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.5.*",
                     status: "unaffected",
                     version: "6.5.12",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.6.*",
                     status: "unaffected",
                     version: "6.6.2",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.7",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/mem: Fix shutdown order\n\nIra reports that removing cxl_mock_mem causes a crash with the following\ntrace:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000044\n [..]\n RIP: 0010:cxl_region_decode_reset+0x7f/0x180 [cxl_core]\n [..]\n Call Trace:\n  <TASK>\n  cxl_region_detach+0xe8/0x210 [cxl_core]\n  cxl_decoder_kill_region+0x27/0x40 [cxl_core]\n  cxld_unregister+0x29/0x40 [cxl_core]\n  devres_release_all+0xb8/0x110\n  device_unbind_cleanup+0xe/0x70\n  device_release_driver_internal+0x1d2/0x210\n  bus_remove_device+0xd7/0x150\n  device_del+0x155/0x3e0\n  device_unregister+0x13/0x60\n  devm_release_action+0x4d/0x90\n  ? __pfx_unregister_port+0x10/0x10 [cxl_core]\n  delete_endpoint+0x121/0x130 [cxl_core]\n  devres_release_all+0xb8/0x110\n  device_unbind_cleanup+0xe/0x70\n  device_release_driver_internal+0x1d2/0x210\n  bus_remove_device+0xd7/0x150\n  device_del+0x155/0x3e0\n  ? lock_release+0x142/0x290\n  cdev_device_del+0x15/0x50\n  cxl_memdev_unregister+0x54/0x70 [cxl_core]\n\nThis crash is due to the clearing out the cxl_memdev's driver context\n(@cxlds) before the subsystem is done with it. This is ultimately due to\nthe region(s), that this memdev is a member, being torn down and expecting\nto be able to de-reference @cxlds, like here:\n\nstatic int cxl_region_decode_reset(struct cxl_region *cxlr, int count)\n...\n                if (cxlds->rcd)\n                        goto endpoint_reset;\n...\n\nFix it by keeping the driver context valid until memdev-device\nunregistration, and subsequently the entire stack of related\ndependencies, unwinds.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-12-19T08:27:09.154Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/20bd0198bebdd706bd4614b3933ef70d7c19618f",
            },
            {
               url: "https://git.kernel.org/stable/c/7c7371b41a14e86f53e7dbe5baa7b1d3e0ab324b",
            },
            {
               url: "https://git.kernel.org/stable/c/cad22a757029c3a1985c221a2d4a6491ad4035ae",
            },
            {
               url: "https://git.kernel.org/stable/c/0ca074f7d788627a4e0b047ca5fbdb5fc567220c",
            },
            {
               url: "https://git.kernel.org/stable/c/88d3917f82ed4215a2154432c26de1480a61b209",
            },
         ],
         title: "cxl/mem: Fix shutdown order",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2023-52849",
      datePublished: "2024-05-21T15:31:45.884Z",
      dateReserved: "2024-05-21T15:19:24.255Z",
      dateUpdated: "2024-12-19T08:27:09.154Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2023-52849\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T16:15:22.023\",\"lastModified\":\"2024-12-30T20:09:41.537\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncxl/mem: Fix shutdown order\\n\\nIra reports that removing cxl_mock_mem causes a crash with the following\\ntrace:\\n\\n BUG: kernel NULL pointer dereference, address: 0000000000000044\\n [..]\\n RIP: 0010:cxl_region_decode_reset+0x7f/0x180 [cxl_core]\\n [..]\\n Call Trace:\\n  <TASK>\\n  cxl_region_detach+0xe8/0x210 [cxl_core]\\n  cxl_decoder_kill_region+0x27/0x40 [cxl_core]\\n  cxld_unregister+0x29/0x40 [cxl_core]\\n  devres_release_all+0xb8/0x110\\n  device_unbind_cleanup+0xe/0x70\\n  device_release_driver_internal+0x1d2/0x210\\n  bus_remove_device+0xd7/0x150\\n  device_del+0x155/0x3e0\\n  device_unregister+0x13/0x60\\n  devm_release_action+0x4d/0x90\\n  ? __pfx_unregister_port+0x10/0x10 [cxl_core]\\n  delete_endpoint+0x121/0x130 [cxl_core]\\n  devres_release_all+0xb8/0x110\\n  device_unbind_cleanup+0xe/0x70\\n  device_release_driver_internal+0x1d2/0x210\\n  bus_remove_device+0xd7/0x150\\n  device_del+0x155/0x3e0\\n  ? lock_release+0x142/0x290\\n  cdev_device_del+0x15/0x50\\n  cxl_memdev_unregister+0x54/0x70 [cxl_core]\\n\\nThis crash is due to the clearing out the cxl_memdev's driver context\\n(@cxlds) before the subsystem is done with it. This is ultimately due to\\nthe region(s), that this memdev is a member, being torn down and expecting\\nto be able to de-reference @cxlds, like here:\\n\\nstatic int cxl_region_decode_reset(struct cxl_region *cxlr, int count)\\n...\\n                if (cxlds->rcd)\\n                        goto endpoint_reset;\\n...\\n\\nFix it by keeping the driver context valid until memdev-device\\nunregistration, and subsequently the entire stack of related\\ndependencies, unwinds.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvió la siguiente vulnerabilidad: cxl/mem: arreglo del orden de apagado. Ira informa que la eliminación de cxl_mock_mem causa un bloqueo con el siguiente rastro: ERROR: desreferencia del puntero NULL del kernel, dirección: 0000000000000044 [..] RIP: 0010: cxl_region_decode_reset+0x7f/0x180 [cxl_core] [..] Seguimiento de llamadas:  cxl_region_detach+0xe8/0x210 [cxl_core] cxl_decoder_kill_region+0x27/0x40 [cxl_core] cxld_unregister+0x29/0x40 [cxl_core] 0x110 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1d2/0x210 bus_remove_device+0xd7/0x150 dispositivo_del+0x155/0x3e0 device_unregister+0x13/0x60 devm_release_action+0x4d/0x90 ? __pfx_unregister_port+0x10/0x10 [cxl_core] delete_endpoint+0x121/0x130 [cxl_core] devres_release_all+0xb8/0x110 device_unbind_cleanup+0xe/0x70 dispositivo_release_driver_internal+0x1d2/0x210 bus_remove_device+0xd7/0x15 0 dispositivo_del+0x155/0x3e0? lock_release+0x142/0x290 cdev_device_del+0x15/0x50 cxl_memdev_unregister+0x54/0x70 [cxl_core] Este bloqueo se debe a que se borró el contexto del controlador de cxl_memdev (@cxlds) antes de que el subsistema termine con él. En última instancia, esto se debe a que las regiones de las que este memdev es miembro están siendo derribadas y esperan poder eliminar la referencia a @cxlds, como aquí: static int cxl_region_decode_reset(struct cxl_region *cxlr, int count) .. si (cxlds-&gt;rcd) pasa a endpoint_reset; ... Solucionelo manteniendo válido el contexto del controlador hasta que se cancele el registro del dispositivo memdev y, posteriormente, toda la pila de dependencias relacionadas.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14.8\",\"versionEndExcluding\":\"5.15.139\",\"matchCriteriaId\":\"51AD3685-34DF-4F34-9122-4437815CA2D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.63\",\"matchCriteriaId\":\"80E1EA7E-2788-466C-9FFB-34AFA1B052F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.5.12\",\"matchCriteriaId\":\"825F64D9-E99F-49AA-8A7B-EF7C2965C5B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.2\",\"matchCriteriaId\":\"4CBFF885-A4D3-4F21-B6FD-4D770034C048\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0ca074f7d788627a4e0b047ca5fbdb5fc567220c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/20bd0198bebdd706bd4614b3933ef70d7c19618f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7c7371b41a14e86f53e7dbe5baa7b1d3e0ab324b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/88d3917f82ed4215a2154432c26de1480a61b209\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cad22a757029c3a1985c221a2d4a6491ad4035ae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0ca074f7d788627a4e0b047ca5fbdb5fc567220c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/20bd0198bebdd706bd4614b3933ef70d7c19618f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7c7371b41a14e86f53e7dbe5baa7b1d3e0ab324b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/88d3917f82ed4215a2154432c26de1480a61b209\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cad22a757029c3a1985c221a2d4a6491ad4035ae\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/20bd0198bebdd706bd4614b3933ef70d7c19618f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7c7371b41a14e86f53e7dbe5baa7b1d3e0ab324b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/cad22a757029c3a1985c221a2d4a6491ad4035ae\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0ca074f7d788627a4e0b047ca5fbdb5fc567220c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/88d3917f82ed4215a2154432c26de1480a61b209\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:11:35.944Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52849\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-10T19:16:24.136793Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-10T19:16:28.563Z\"}}], \"cna\": {\"title\": \"cxl/mem: Fix shutdown order\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9cc238c7a526\", \"lessThan\": \"20bd0198bebd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9cc238c7a526\", \"lessThan\": \"7c7371b41a14\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9cc238c7a526\", \"lessThan\": \"cad22a757029\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9cc238c7a526\", \"lessThan\": \"0ca074f7d788\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9cc238c7a526\", \"lessThan\": \"88d3917f82ed\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/cxl/core/memdev.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"5.15.139\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.63\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.5.12\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.5.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.2\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/cxl/core/memdev.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/20bd0198bebdd706bd4614b3933ef70d7c19618f\"}, {\"url\": \"https://git.kernel.org/stable/c/7c7371b41a14e86f53e7dbe5baa7b1d3e0ab324b\"}, {\"url\": \"https://git.kernel.org/stable/c/cad22a757029c3a1985c221a2d4a6491ad4035ae\"}, {\"url\": \"https://git.kernel.org/stable/c/0ca074f7d788627a4e0b047ca5fbdb5fc567220c\"}, {\"url\": \"https://git.kernel.org/stable/c/88d3917f82ed4215a2154432c26de1480a61b209\"}], \"x_generator\": {\"engine\": \"bippy-a5840b7849dd\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncxl/mem: Fix shutdown order\\n\\nIra reports that removing cxl_mock_mem causes a crash with the following\\ntrace:\\n\\n BUG: kernel NULL pointer dereference, address: 0000000000000044\\n [..]\\n RIP: 0010:cxl_region_decode_reset+0x7f/0x180 [cxl_core]\\n [..]\\n Call Trace:\\n  <TASK>\\n  cxl_region_detach+0xe8/0x210 [cxl_core]\\n  cxl_decoder_kill_region+0x27/0x40 [cxl_core]\\n  cxld_unregister+0x29/0x40 [cxl_core]\\n  devres_release_all+0xb8/0x110\\n  device_unbind_cleanup+0xe/0x70\\n  device_release_driver_internal+0x1d2/0x210\\n  bus_remove_device+0xd7/0x150\\n  device_del+0x155/0x3e0\\n  device_unregister+0x13/0x60\\n  devm_release_action+0x4d/0x90\\n  ? __pfx_unregister_port+0x10/0x10 [cxl_core]\\n  delete_endpoint+0x121/0x130 [cxl_core]\\n  devres_release_all+0xb8/0x110\\n  device_unbind_cleanup+0xe/0x70\\n  device_release_driver_internal+0x1d2/0x210\\n  bus_remove_device+0xd7/0x150\\n  device_del+0x155/0x3e0\\n  ? lock_release+0x142/0x290\\n  cdev_device_del+0x15/0x50\\n  cxl_memdev_unregister+0x54/0x70 [cxl_core]\\n\\nThis crash is due to the clearing out the cxl_memdev's driver context\\n(@cxlds) before the subsystem is done with it. This is ultimately due to\\nthe region(s), that this memdev is a member, being torn down and expecting\\nto be able to de-reference @cxlds, like here:\\n\\nstatic int cxl_region_decode_reset(struct cxl_region *cxlr, int count)\\n...\\n                if (cxlds->rcd)\\n                        goto endpoint_reset;\\n...\\n\\nFix it by keeping the driver context valid until memdev-device\\nunregistration, and subsequently the entire stack of related\\ndependencies, unwinds.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-05-29T05:18:25.009Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2023-52849\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T23:11:35.944Z\", \"dateReserved\": \"2024-05-21T15:19:24.255Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T15:31:45.884Z\", \"assignerShortName\": \"Linux\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.