CVE-2023-52629

sh: push-switch: Reorder cleanup operations to avoid use-after-free bug

Published Mar 29, 2024 CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Description
In the Linux kernel, the following vulnerability has been resolved:

sh: push-switch: Reorder cleanup operations to avoid use-after-free bug

The original code puts flush_work() before timer_shutdown_sync()
in switch_drv_remove(). Although we use flush_work() to stop
the worker, it could be rescheduled in switch_timer(). As a result,
a use-after-free bug can occur. The details are shown below:

(cpu 0) | (cpu 1)
switch_drv_remove() |
flush_work() |
... | switch_timer // timer
| schedule_work(&psw->work)
timer_shutdown_sync() |
... | switch_work_handler // worker
kfree(psw) // free |
| psw->state = 0 // use

This patch puts timer_shutdown_sync() before flush_work() to
mitigate the bugs. As a result, the worker and timer will be
stopped safely before the deallocate operations.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4841-1 linux security update
Ubuntu USN Ubuntu USN USN-6972-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6972-2 Linux kernel (AWS) vulnerabilities
Ubuntu USN Ubuntu USN USN-6972-3 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-6972-4 Linux kernel (Oracle) vulnerabilities
Ubuntu USN Ubuntu USN USN-6973-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6973-2 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-6973-3 Linux kernel (AWS) vulnerabilities
Ubuntu USN Ubuntu USN USN-6973-4 Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN Ubuntu USN USN-6974-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6974-2 Linux kernel (Oracle) vulnerabilities
Ubuntu USN Ubuntu USN USN-7006-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7019-1 Linux kernel vulnerabilities
History
Type Values Removed Values Added
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
Linux
Published
Updated
Oct 3, 2026, 10:54 AM
Reserved
Mar 6, 2024, 9:52 AM
Status
Modified
Published
Mar 29, 2024, 10:15 AM
Modified
Oct 3, 2026, 11:17 AM
Severity
Moderate
Public date
Mar 29, 2024, 12:00 AM