Vulnerability-Lookup

FKIE_CVE-2023-52439

Vulnerability from fkie_nvd - Published: 2024-02-20 21:15 - Updated: 2026-08-04 10:18

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/0c9ae0b8605078eafc3bea053cc78791e97ba2e2	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/17a8519cb359c3b483fb5c7367efa9a8a508bdea	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/3174e0f7de1ba392dc191625da83df02d695b60c	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/35f102607054faafe78d2a6994b18d5d9d6e92ad	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5cf604ee538ed0c467abe3b4cda5308a6398f0f7	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5e0be1229ae199ebb90b33102f74a0f22d152570	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/913205930da6213305616ac539447702eaa85e41	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e93da893d52d82d57fc0db2ca566024e0f26ff50	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/0c9ae0b8605078eafc3bea053cc78791e97ba2e2	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/17a8519cb359c3b483fb5c7367efa9a8a508bdea	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/3174e0f7de1ba392dc191625da83df02d695b60c	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/35f102607054faafe78d2a6994b18d5d9d6e92ad	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/5cf604ee538ed0c467abe3b4cda5308a6398f0f7	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/5e0be1229ae199ebb90b33102f74a0f22d152570	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/913205930da6213305616ac539447702eaa85e41	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/e93da893d52d82d57fc0db2ca566024e0f26ff50	Patch
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
af854a3a-2127-422b-91ae-364da2661108	https://security.netapp.com/advisory/ntap-20241227-0006/

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	4.18
linux	linux_kernel	4.18
linux	linux_kernel	4.18
linux	linux_kernel	4.18
linux	linux_kernel	4.18

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/uio/uio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3174e0f7de1ba392dc191625da83df02d695b60c",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "e93da893d52d82d57fc0db2ca566024e0f26ff50",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "5e0be1229ae199ebb90b33102f74a0f22d152570",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "5cf604ee538ed0c467abe3b4cda5308a6398f0f7",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "17a8519cb359c3b483fb5c7367efa9a8a508bdea",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "35f102607054faafe78d2a6994b18d5d9d6e92ad",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "913205930da6213305616ac539447702eaa85e41",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "0c9ae0b8605078eafc3bea053cc78791e97ba2e2",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "13af019c87f2d90e663742cb1a819834048842ae",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.100",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/uio/uio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.306",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.268",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.74",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A94A44F-4F9A-4447-AF13-47B88B4CD211",
              "versionEndExcluding": "4.19.306",
              "versionStartExcluding": "4.18.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "35ADF607-EDCA-45AB-8FB6-9F2D40D47C0C",
              "versionEndExcluding": "5.4.268",
              "versionStartIncluding": "4.20.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D2E4F24-2FBB-4434-8598-2B1499E566B5",
              "versionEndExcluding": "5.10.209",
              "versionStartIncluding": "5.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E25E1389-4B0F-407A-9C94-5908FF3EE88B",
              "versionEndExcluding": "5.15.148",
              "versionStartIncluding": "5.11.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7DD9841-CE11-470D-A285-A2E8E0F6640D",
              "versionEndExcluding": "6.1.74",
              "versionStartIncluding": "5.16.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "74A1FFC7-19FA-450E-BC2D-2BBD2EBF0A5F",
              "versionEndExcluding": "6.6.13",
              "versionStartIncluding": "6.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "664EB721-F519-48BB-B1C8-897D5990CD78",
              "versionEndExcluding": "6.7.1",
              "versionStartIncluding": "6.7.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.18:-:*:*:*:*:*:*",
              "matchCriteriaId": "6AE7DC47-EAFA-42D5-BCF5-C7039EE3D771",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.18:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "DB2B91AF-ACE1-4F6F-B2D0-9D4B7D8D20CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.18:rc6:*:*:*:*:*:*",
              "matchCriteriaId": "30FBD992-DD41-441E-A6C7-D39DAC45DA34",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.18:rc7:*:*:*:*:*:*",
              "matchCriteriaId": "10979D17-76B4-465F-A475-78680FBECEBD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.18:rc8:*:*:*:*:*:*",
              "matchCriteriaId": "56BF1EDD-3351-4E3E-AD42-54AF093ADB89",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuio: Fix use-after-free in uio_open\n\ncore-1\t\t\t\tcore-2\n-------------------------------------------------------\nuio_unregister_device\t\tuio_open\n\t\t\t\tidev = idr_find()\ndevice_unregister(\u0026idev-\u003edev)\nput_device(\u0026idev-\u003edev)\nuio_device_release\n\t\t\t\tget_device(\u0026idev-\u003edev)\nkfree(idev)\nuio_free_minor(minor)\n\t\t\t\tuio_release\n\t\t\t\tput_device(\u0026idev-\u003edev)\n\t\t\t\tkfree(idev)\n-------------------------------------------------------\n\nIn the core-1 uio_unregister_device(), the device_unregister will kfree\nidev when the idev-\u003edev kobject ref is 1. But after core-1\ndevice_unregister, put_device and before doing kfree, the core-2 may\nget_device. Then:\n1. After core-1 kfree idev, the core-2 will do use-after-free for idev.\n2. When core-2 do uio_release and put_device, the idev will be double\n   freed.\n\nTo address this issue, we can get idev atomic \u0026 inc idev reference with\nminor_lock."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: uio: corrige use-after-free en uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(\u0026amp;idev-\u0026gt;dev) put_device(\u0026amp;idev-\u0026gt;dev) uio_device_release get_device(\u0026amp;idev-\u0026gt;dev) kfree(idev) uio_free_minor(minor) uio_release put_device(\u0026amp;idev-\u0026gt;dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister se liberar\u00e1 idev cuando la referencia del objeto idev-\u0026gt;dev kobject es 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, el idev se liberar\u00e1 dos veces. Para solucionar este problema, podemos obtener la referencia de idev atomic \u0026amp; inc idev con minor_lock."
    }
  ],
  "id": "CVE-2023-52439",
  "lastModified": "2026-08-04T10:18:27.190",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-52439",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-09-10T16:02:55.773038Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-02-20T21:15:08.213",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/0c9ae0b8605078eafc3bea053cc78791e97ba2e2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/17a8519cb359c3b483fb5c7367efa9a8a508bdea"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/3174e0f7de1ba392dc191625da83df02d695b60c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/35f102607054faafe78d2a6994b18d5d9d6e92ad"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5cf604ee538ed0c467abe3b4cda5308a6398f0f7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5e0be1229ae199ebb90b33102f74a0f22d152570"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/913205930da6213305616ac539447702eaa85e41"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e93da893d52d82d57fc0db2ca566024e0f26ff50"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/0c9ae0b8605078eafc3bea053cc78791e97ba2e2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/17a8519cb359c3b483fb5c7367efa9a8a508bdea"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/3174e0f7de1ba392dc191625da83df02d695b60c"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/35f102607054faafe78d2a6994b18d5d9d6e92ad"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5cf604ee538ed0c467abe3b4cda5308a6398f0f7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5e0be1229ae199ebb90b33102f74a0f22d152570"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/913205930da6213305616ac539447702eaa85e41"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e93da893d52d82d57fc0db2ca566024e0f26ff50"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20241227-0006/"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-415"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2023-52439 (GCVE-0-2023-52439)

Vulnerability from cvelistv5 – Published: 2024-02-20 18:34 – Updated: 2026-08-05 09:09

Title

uio: Fix use-after-free in uio_open

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:02 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6847 records in the last 180 days details

References

11 references

URL	Tags
https://git.kernel.org/stable/c/3174e0f7de1ba392d…
https://git.kernel.org/stable/c/e93da893d52d82d57…
https://git.kernel.org/stable/c/5e0be1229ae199ebb…
https://git.kernel.org/stable/c/5cf604ee538ed0c46…
https://git.kernel.org/stable/c/17a8519cb359c3b48…
https://git.kernel.org/stable/c/35f102607054faafe…
https://git.kernel.org/stable/c/913205930da621330…
https://git.kernel.org/stable/c/0c9ae0b8605078eaf…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://security.netapp.com/advisory/ntap-2024122…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 57c5f4df0a5a0ee83df799991251e2ee93a5e4e9 , < 3174e0f7de1ba392dc191625da83df02d695b60c (git) Affected: 57c5f4df0a5a0ee83df799991251e2ee93a5e4e9 , < e93da893d52d82d57fc0db2ca566024e0f26ff50 (git) Affected: 57c5f4df0a5a0ee83df799991251e2ee93a5e4e9 , < 5e0be1229ae199ebb90b33102f74a0f22d152570 (git) Affected: 57c5f4df0a5a0ee83df799991251e2ee93a5e4e9 , < 5cf604ee538ed0c467abe3b4cda5308a6398f0f7 (git) Affected: 57c5f4df0a5a0ee83df799991251e2ee93a5e4e9 , < 17a8519cb359c3b483fb5c7367efa9a8a508bdea (git) Affected: 57c5f4df0a5a0ee83df799991251e2ee93a5e4e9 , < 35f102607054faafe78d2a6994b18d5d9d6e92ad (git) Affected: 57c5f4df0a5a0ee83df799991251e2ee93a5e4e9 , < 913205930da6213305616ac539447702eaa85e41 (git) Affected: 57c5f4df0a5a0ee83df799991251e2ee93a5e4e9 , < 0c9ae0b8605078eafc3bea053cc78791e97ba2e2 (git) Affected: 13af019c87f2d90e663742cb1a819834048842ae (git) Affected: 4.14.100 , < 4.15 (semver)
Linux	Linux	Affected: 4.18 Unaffected: 0 , < 4.18 (semver) Unaffected: 4.19.306 , ≤ 4.19.* (semver) Unaffected: 5.4.268 , ≤ 5.4.* (semver) Unaffected: 5.10.209 , ≤ 5.10.* (semver) Unaffected: 5.15.148 , ≤ 5.15.* (semver) Unaffected: 6.1.74 , ≤ 6.1.* (semver) Unaffected: 6.6.13 , ≤ 6.6.* (semver) Unaffected: 6.7.1 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-12-27T16:03:00.894Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3174e0f7de1ba392dc191625da83df02d695b60c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e93da893d52d82d57fc0db2ca566024e0f26ff50"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5e0be1229ae199ebb90b33102f74a0f22d152570"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5cf604ee538ed0c467abe3b4cda5308a6398f0f7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/17a8519cb359c3b483fb5c7367efa9a8a508bdea"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/35f102607054faafe78d2a6994b18d5d9d6e92ad"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/913205930da6213305616ac539447702eaa85e41"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0c9ae0b8605078eafc3bea053cc78791e97ba2e2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241227-0006/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52439",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:02:55.773038Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:35.621Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/uio/uio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3174e0f7de1ba392dc191625da83df02d695b60c",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "e93da893d52d82d57fc0db2ca566024e0f26ff50",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "5e0be1229ae199ebb90b33102f74a0f22d152570",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "5cf604ee538ed0c467abe3b4cda5308a6398f0f7",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "17a8519cb359c3b483fb5c7367efa9a8a508bdea",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "35f102607054faafe78d2a6994b18d5d9d6e92ad",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "913205930da6213305616ac539447702eaa85e41",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "0c9ae0b8605078eafc3bea053cc78791e97ba2e2",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "13af019c87f2d90e663742cb1a819834048842ae",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.100",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/uio/uio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.306",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.268",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.74",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.306",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.268",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.209",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.148",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.74",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.13",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.1",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.100",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuio: Fix use-after-free in uio_open\n\ncore-1\t\t\t\tcore-2\n-------------------------------------------------------\nuio_unregister_device\t\tuio_open\n\t\t\t\tidev = idr_find()\ndevice_unregister(\u0026idev-\u003edev)\nput_device(\u0026idev-\u003edev)\nuio_device_release\n\t\t\t\tget_device(\u0026idev-\u003edev)\nkfree(idev)\nuio_free_minor(minor)\n\t\t\t\tuio_release\n\t\t\t\tput_device(\u0026idev-\u003edev)\n\t\t\t\tkfree(idev)\n-------------------------------------------------------\n\nIn the core-1 uio_unregister_device(), the device_unregister will kfree\nidev when the idev-\u003edev kobject ref is 1. But after core-1\ndevice_unregister, put_device and before doing kfree, the core-2 may\nget_device. Then:\n1. After core-1 kfree idev, the core-2 will do use-after-free for idev.\n2. When core-2 do uio_release and put_device, the idev will be double\n   freed.\n\nTo address this issue, we can get idev atomic \u0026 inc idev reference with\nminor_lock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires opening a local UIO character device (/dev/uioN) via the open syscall; the vulnerable uio_open path is not reachable from the network stack or remote protocols.\nAC:L - An attacker who can open /dev/uioN can repeatedly race open against concurrent uio_unregister_device (e.g. TCMU configfs destroy or driver unbind they can also drive), so both sides of the race are attacker-influenced and do not depend on blind external timing.\nPR:L - uio_open has no capability check; access is gated only by /dev/uio* permissions, and worst-case deployments (industrial/DPDK udev rules, TCMU service accounts) grant this to unprivileged users. The UAF at get_device occurs before any driver-specific open hooks.\nUI:N - No separate victim action is required; the attacker triggers the race directly by opening the device while unregister runs.\nS:U - This is a same-host kernel heap UAF/double-free leading to privilege escalation within the kernel\u0027s security authority, not a VM/IOMMU/sandbox boundary escape.\nC:H - Use-after-free of struct uio_device lets the attacker reclaim and control the freed object contents, enabling arbitrary kernel memory disclosure primitives.\nI:H - The same UAF plus the documented double-free on put_device/uio_device_release enables heap corruption and arbitrary write/control-flow hijacking in the kernel.\nA:H - Dereferencing or double-freeing the reclaimed uio_device reliably causes kernel oops/panic even when not fully exploited for code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:09:56.653Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3174e0f7de1ba392dc191625da83df02d695b60c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e93da893d52d82d57fc0db2ca566024e0f26ff50"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e0be1229ae199ebb90b33102f74a0f22d152570"
        },
        {
          "url": "https://git.kernel.org/stable/c/5cf604ee538ed0c467abe3b4cda5308a6398f0f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/17a8519cb359c3b483fb5c7367efa9a8a508bdea"
        },
        {
          "url": "https://git.kernel.org/stable/c/35f102607054faafe78d2a6994b18d5d9d6e92ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/913205930da6213305616ac539447702eaa85e41"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c9ae0b8605078eafc3bea053cc78791e97ba2e2"
        }
      ],
      "title": "uio: Fix use-after-free in uio_open",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52439",
    "datePublished": "2024-02-20T18:34:49.323Z",
    "dateReserved": "2024-02-20T12:30:33.291Z",
    "dateUpdated": "2026-08-05T09:09:56.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted