Linux: Double Free
CVE-2023-53616 is a high-severity double free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions c3c0f0ddd851b3fa3e9d3450bbcd561f4f850469, 114ea3cb13ab25f7178cb60283adb93d2f96dad7, 5873df0195124be2f357de11bfd473ead4f90ed8 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.16% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to c3c0f0ddd851b3fa3e9d3450bbcd561f4f850469 or 114ea3cb13ab25f7178cb60283adb93d2f96dad7 or 5873df0195124be2f357de11bfd473ead4f90ed8 or 756747d4b439e3e1159282ae89f17eefebbe9b25, whichever matches your release line, or a later version.
- Update Linux Kernel to 4.14.326 or 4.19.295 or 5.4.257 or 5.10.197, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, c3c0f0ddd851b3fa3e9d3450bbcd561f4f850469; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 114ea3cb13ab25f7178cb60283adb93d2f96dad7; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 5873df0195124be2f357de11bfd473ead4f90ed8; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 756747d4b439e3e1159282ae89f17eefebbe9b25; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, ef7311101ca43dd73b45bca7a30ac72d9535ff87; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 4de3a603010e0ca334487de24c6aab0777b7f808; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 88484bde6f12126616b38e43b6c00edcd941f615; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 6e2bda2c192d0244b5a78b787ef20aa10cb319b7; and 1 more ranges | c3c0f0ddd851b3fa3e9d3450bbcd561f4f850469, 114ea3cb13ab25f7178cb60283adb93d2f96dad7, 5873df0195124be2f357de11bfd473ead4f90ed8, 756747d4b439e3e1159282ae89f17eefebbe9b25, ef7311101ca43dd73b45bca7a30ac72d9535ff87, 4de3a603010e0ca334487de24c6aab0777b7f808 |
| Linux | Linux Kernel | 2.6.12.1 up to, but not including, 4.14.326; 4.15 up to, but not including, 4.19.295; 4.20 up to, but not including, 5.4.257; 5.5 up to, but not including, 5.10.197; 5.11 up to, but not including, 5.15.133; 5.16 up to, but not including, 6.1.55; 6.2 up to, but not including, 6.5.5; 2.6.12 | 4.14.326, 4.19.295, 5.4.257, 5.10.197, 5.15.133, 6.1.55 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount syzbot found an invalid-free in diUnmount: BUG: KASAN: double-free in slab_free mm/slub.c:3661 [inline] BUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 mm/slub.c:3674 Free of addr ffff88806f410000 by task syz-executor131/3632 CPU: 0 PID: 3632 Comm: syz-executor131 Not tainted 6.1.0-rc7-syzkaller-00012-gca57f02295f1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report_invalid_free+0xac/0xd0 mm/kasan/report.c:460 ____kasan_slab_free+0xfb/0x120 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1724 [inline] slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1750 slab_free mm/slub.c:3661 [inline] __kmem_cache_free+0x71/0x110 mm/slub.c:3674 diUnmount+0xef/0x100 fs/jfs/jfs_imap.c:195 jfs_umount+0x108/0x370 fs/jfs/jfs_umount.c:63 jfs_put_super+0x86/0x190 fs/jfs/super.c:194 generic_shutdown_super+0x130/0x310 fs/super.c:492 kill_block_super+0x79/0xd0 fs/super.c:1428 deactivate_locked_super+0xa7/0xf0 fs/super.c:332 cleanup_mnt+0x494/0x520 fs/namespace.c:1186 task_work_run+0x243/0x300 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0x664/0x2070 kernel/exit.c:820 do_group_exit+0x1fd/0x2b0 kernel/exit.c:950 __do_sys_exit_group kernel/exit.c:961 [inline] __se_sys_exit_group kernel/exit.c:959 [inline] __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:959 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] JFS_IP(ipimap)->i_imap is not setting to NULL after free in diUnmount. If jfs_remount() free JFS_IP(ipimap)->i_imap but then failed at diMount(). JFS_IP(ipimap)->i_imap will be freed once again. Fix this problem by setting JFS_IP(ipimap)->i_imap to NULL after free.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Double Free
The product calls free() twice on the same memory address.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
- Use a static analysis tool to find double free instances.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/114ea3cb13ab25f7178cb60283adb93d2f96dad7
- git.kernel.org/stable/c/4de3a603010e0ca334487de24c6aab0777b7f808
- git.kernel.org/stable/c/5873df0195124be2f357de11bfd473ead4f90ed8
- git.kernel.org/stable/c/6e2bda2c192d0244b5a78b787ef20aa10cb319b7
- git.kernel.org/stable/c/756747d4b439e3e1159282ae89f17eefebbe9b25
- git.kernel.org/stable/c/88484bde6f12126616b38e43b6c00edcd941f615
- git.kernel.org/stable/c/c3c0f0ddd851b3fa3e9d3450bbcd561f4f850469
- git.kernel.org/stable/c/ef7311101ca43dd73b45bca7a30ac72d9535ff87
Recent Double Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.