Riskcovery

CVE-2023-52584

spmi: mediatek: Fix UAF on device remove

State
Published
Severity
3.8 Low
Published
Mar 6, 2024
Updated
May 11, 2026
Reserved
Mar 2, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

spmi: mediatek: Fix UAF on device remove

The pmif driver data that contains the clocks is allocated along with spmi_controller. On device remove, spmi_controller will be freed first, and then devres , including the clocks, will be cleanup. This leads to UAF because putting the clocks will access the clocks in the pmif driver data, which is already freed along with spmi_controller.

This can be reproduced by enabling DEBUG_TEST_DRIVER_REMOVE and building the kernel with KASAN.

Fix the UAF issue by using unmanaged clk_bulk_get() and putting the clocks before freeing spmi_controller.

Scores

CVSSScoreVectorSource
3.13.8 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:NCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • b45b3ccef8c063d21eb746d85337eaf71f6b5f07 to before 521f28eedd6b14228c46e3b81e3bf9b90c2818d8Affected
  • b45b3ccef8c063d21eb746d85337eaf71f6b5f07 to before f8dcafcb54632536684336161da8bdd52120f95eAffected
  • b45b3ccef8c063d21eb746d85337eaf71f6b5f07 to before 9a3881b1f07db1bb55cb0108e6f05cfd027eaf2eAffected
  • b45b3ccef8c063d21eb746d85337eaf71f6b5f07 to before e821d50ab5b956ed0effa49faaf29912fd4106d9Affected
LinuxLinux
  • 5.17Affected
  • before 5.17Not affected
  • 6.1.77 through 6.1.*Not affected
  • 6.6.16 through 6.6.*Not affected
  • 6.7.4 through 6.7.*Not affected
  • 6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.