CVE-2023-53235

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/tests: helpers: Avoid a driver uaf

when using __drm_kunit_helper_alloc_drm_device() the driver may be

dereferenced by device-managed resources up until the device is

freed, which is typically later than the kunit-managed resource code

frees it. Fix this by simply make the driver device-managed as well.

In short, the sequence leading to the UAF is as follows:

INIT:

Code allocates a struct device as a kunit-managed resource.

Code allocates a drm driver as a kunit-managed resource.

Code allocates a drm device as a device-managed resource.

EXIT:

Kunit resource cleanup frees the drm driver

Kunit resource cleanup puts the struct device, which starts a

device-managed resource cleanup

device-managed cleanup calls drm_dev_put()

drm_dev_put() dereferences the (now freed) drm driver -> Boom.

Related KASAN message:

[55272.551542] ==================================================================

[55272.551551] BUG:

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References