CyberSecBulletin
CVE-2023-53446NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2023-53446 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 666e7f9d60cee23077ea3e6331f6f8a19f7ea03f, 7badf4d6f49a358a01ab072bbff88d3ee886c33b, 9856c0de49052174ab474113f4ba40c02aaee086 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.15% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 666e7f9d60cee23077ea3e6331f6f8a19f7ea03f or 7badf4d6f49a358a01ab072bbff88d3ee886c33b or 9856c0de49052174ab474113f4ba40c02aaee086 or 7aecdd47910c51707696e8b0e045b9f88bd4230f, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.4.251 or 5.10.188 or 5.15.121 or 6.1.39, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxb5a0a9b59c8185aebcd9a717e2e6258b58c72c06 up to, but not including, 666e7f9d60cee23077ea3e6331f6f8a19f7ea03f; b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 up to, but not including, 7badf4d6f49a358a01ab072bbff88d3ee886c33b; b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 up to, but not including, 9856c0de49052174ab474113f4ba40c02aaee086; b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 up to, but not including, 7aecdd47910c51707696e8b0e045b9f88bd4230f; b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 up to, but not including, d51d2eeae4ce54d542909c4d9d07bf371a78592c; b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 up to, but not including, 4203722d51afe3d239e03f15cc73efdf023a7103; b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 up to, but not including, 456d8aa37d0f56fc9e985e812496e861dcd6f2f2; 4.11666e7f9d60cee23077ea3e6331f6f8a19f7ea03f, 7badf4d6f49a358a01ab072bbff88d3ee886c33b, 9856c0de49052174ab474113f4ba40c02aaee086, 7aecdd47910c51707696e8b0e045b9f88bd4230f, d51d2eeae4ce54d542909c4d9d07bf371a78592c, 4203722d51afe3d239e03f15cc73efdf023a7103
LinuxLinux Kernel4.11 up to, but not including, 5.4.251; 5.5 up to, but not including, 5.10.188; 5.11 up to, but not including, 5.15.121; 5.16 up to, but not including, 6.1.39; 6.2 up to, but not including, 6.3.13; 6.4 up to, but not including, 6.4.45.4.251, 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighNVD
CVSS 3.17.8HighCISA (ADP)

Official description

In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free Struct pcie_link_state->downstream is a pointer to the pci_dev of function 0. Previously we retained that pointer when removing function 0, and subsequent ASPM policy changes dereferenced it, resulting in a use-after-free warning from KASAN, e.g.: # echo 1 > /sys/bus/pci/devices/0000:03:00.0/remove # echo powersave > /sys/module/pcie_aspm/parameters/policy BUG: KASAN: slab-use-after-free in pcie_config_aspm_link+0x42d/0x500 Call Trace: kasan_report+0xae/0xe0 pcie_config_aspm_link+0x42d/0x500 pcie_aspm_set_policy+0x8e/0x1a0 param_attr_store+0x162/0x2c0 module_attr_store+0x3e/0x80 PCIe spec r6.0, sec 7.5.3.7, recommends that software program the same ASPM Control value in all functions of multi-function devices. Disable ASPM and free the pcie_link_state when any child function is removed so we can discard the dangling pcie_link_state->downstream pointer and maintain the same ASPM Control configuration for all functions. [bhelgaas: commit log and comment]

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.