CVE-2023-52468

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

class: fix use-after-free in class_register()

The lock_class_key is still registered and can be found in

lock_keys_hash hlist after subsys_private is freed in error

handler path.A task who iterate over the lock_keys_hash

later may cause use-after-free.So fix that up and unregister

the lock_class_key before kfree(cp).

On our platform, a driver fails to kset_register because of

creating duplicate filename '/class/xxx'.With Kasan enabled,

it prints a invalid-access bug report.

KASAN bug report:

BUG: KASAN: invalid-access in lockdep_register_key+0x19c/0x1bc

Write of size 8 at addr 15ffff808b8c0368 by task modprobe/252

Pointer tag: [15], memory tag: [fe]

CPU: 7 PID: 252 Comm: modprobe Tainted: G W

6.6.0-mainline-maybe-dirty #1

Call trace:

dump_backtrace+0x1b0/0x1e4

show_stack+0x2c/0x40

dump_stack_lvl+0xac/0xe0

print_report+0x18c/0x4d8

kasan_report+0xe8/0x148

__hwasan_store8_noabort+0x88/0x98

lockdep_register_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References