CVE-2023-52584

spmi: mediatek: Fix UAF on device remove

Low · published March 6, 2024

CVSS v3.1
3.8
EPSS
1%
Percentile
46.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

spmi: mediatek: Fix UAF on device remove

The pmif driver data that contains the clocks is allocated along with

spmi_controller.

On device remove, spmi_controller will be freed first, and then devres

, including the clocks, will be cleanup.

This leads to UAF because putting the clocks will access the clocks in

the pmif driver data, which is already freed along with spmi_controller.

This can be reproduced by enabling DEBUG_TEST_DRIVER_REMOVE and

building the kernel with KASAN.

Fix the UAF issue by using unmanaged clk_bulk_get() and putting the

clocks before freeing spmi_controller.

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00562 · 46.0th percentile
Published
2024-03-06T06:45Z
EPSS history
Timeline
  • 06 MAR 06:45Z
    spmi: mediatek: Fix UAF on device remove
    cvelistv5