CVE-2023-52731CWE-125

CVE-2023-52731

High · published May 21, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
15.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

fbdev: Fix invalid page access after closing deferred I/O devices

When a fbdev with deferred I/O is once opened and closed, the dirty

pages still remain queued in the pageref list, and eventually later

those may be processed in the delayed work. This may lead to a

corruption of pages, hitting an Oops.

This patch makes sure to cancel the delayed work and clean up the

pageref list at closing the device for addressing the bug. A part of

the cleanup code is factored out as a new helper function that is

called from the common fb_release().

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00247 · 15.1th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2024-05-21T20:15Z
Affected products (9)
ProductVersionsFixed in
linux/linux_kernel≥ 5.19, < 6.1.136.1.13
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (6)
EPSS history
Timeline
  • 21 MAY 15:22Z
    fbdev: Fix invalid page access after closing deferred I/O devices
    cvelistv5