In the Linux kernel, the following vulnerability has been resolved:
sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
The original code puts flush_work() before timer_shutdown_sync()
in switch_drv_remove(). Although we use flush_work() to stop
the worker, it could be rescheduled in switch_timer(). As a result,
a use-after-free bug can occur. The details are shown below:
(cpu 0) | (cpu 1)
switch_drv_remove() |
flush_work() |
... | switch_timer // timer
| schedule_work(&psw->work)
timer_shutdown_sync() |
... | switch_work_handler // worker
kfree(psw) // free |
| psw->state = 0 // use
This patch puts timer_shutdown_sync() before flush_work() to
mitigate the bugs. As a result, the worker and timer will be
stopped safely before the deallocate operations.
References
Configurations
History
08 Apr 2025, 19:28
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux linux Kernel
Linux |
|
| References | () https://git.kernel.org/stable/c/246f80a0b17f8f582b2c0996db02998239057c65 - Patch | |
| References | () https://git.kernel.org/stable/c/610dbd8ac271aa36080aac50b928d700ee3fe4de - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
21 Nov 2024, 08:40
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/246f80a0b17f8f582b2c0996db02998239057c65 - | |
| References | () https://git.kernel.org/stable/c/610dbd8ac271aa36080aac50b928d700ee3fe4de - |
01 Aug 2024, 13:45
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.4 |
| CWE | CWE-416 |
29 Mar 2024, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-29 10:15
Updated : 2025-04-08 19:28
NVD link : CVE-2023-52629
Mitre link : CVE-2023-52629
CVE.ORG link : CVE-2023-52629
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free