CVE-2023-52609

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52609
In the Linux kernel, the following vulnerability has been resolved: binder: fix race between mmput() and do_exit() Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmget_not_zero() first. This can race with Task B do_exit() and the final mmput() refcount decrement will come from Task A. Task A | Task B ------------------+------------------ mmget_not_zero() | | do_exit() | exit_mm() | mmput() mmput() | exit_mmap() | remove_vma() | fput() | In this case, the work of ____fput() from Task B is queued up in Task A as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it's dead). This means the binder_deferred_release() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then. In order to fix this use mmput_async() that will schedule the work in the corresponding mm->async_put_work WQ instead of Task A.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/252a2a5569eb9f8d16428872cc24dea1ac0bb097 Mailing List Patch
https://git.kernel.org/stable/c/6696f76c32ff67fec26823fc2df46498e70d9bf3 Mailing List Patch
https://git.kernel.org/stable/c/67f16bf2cc1698fd50e01ee8a2becc5a8e6d3a3e Mailing List Patch
https://git.kernel.org/stable/c/77d210e8db4d61d43b2d16df66b1ec46fad2ee01 Mailing List Patch
https://git.kernel.org/stable/c/7e7a0d86542b0ea903006d3f42f33c4f7ead6918 Mailing List Patch
https://git.kernel.org/stable/c/95b1d336b0642198b56836b89908d07b9a0c9608 Mailing List Patch
https://git.kernel.org/stable/c/98fee5bee97ad47b527a997d5786410430d1f0e9 Mailing List Patch
https://git.kernel.org/stable/c/9a9ab0d963621d9d12199df9817e66982582d5a5 Mailing List Patch
https://git.kernel.org/stable/c/252a2a5569eb9f8d16428872cc24dea1ac0bb097 Mailing List Patch
https://git.kernel.org/stable/c/6696f76c32ff67fec26823fc2df46498e70d9bf3 Mailing List Patch
https://git.kernel.org/stable/c/67f16bf2cc1698fd50e01ee8a2becc5a8e6d3a3e Mailing List Patch
https://git.kernel.org/stable/c/77d210e8db4d61d43b2d16df66b1ec46fad2ee01 Mailing List Patch
https://git.kernel.org/stable/c/7e7a0d86542b0ea903006d3f42f33c4f7ead6918 Mailing List Patch
https://git.kernel.org/stable/c/95b1d336b0642198b56836b89908d07b9a0c9608 Mailing List Patch
https://git.kernel.org/stable/c/98fee5bee97ad47b527a997d5786410430d1f0e9 Mailing List Patch
https://git.kernel.org/stable/c/9a9ab0d963621d9d12199df9817e66982582d5a5 Mailing List Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html Mailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

10 Mar 2025, 15:10

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
CWE CWE-362
References () https://git.kernel.org/stable/c/252a2a5569eb9f8d16428872cc24dea1ac0bb097 - () https://git.kernel.org/stable/c/252a2a5569eb9f8d16428872cc24dea1ac0bb097 - Mailing List, Patch
References () https://git.kernel.org/stable/c/6696f76c32ff67fec26823fc2df46498e70d9bf3 - () https://git.kernel.org/stable/c/6696f76c32ff67fec26823fc2df46498e70d9bf3 - Mailing List, Patch
References () https://git.kernel.org/stable/c/67f16bf2cc1698fd50e01ee8a2becc5a8e6d3a3e - () https://git.kernel.org/stable/c/67f16bf2cc1698fd50e01ee8a2becc5a8e6d3a3e - Mailing List, Patch
References () https://git.kernel.org/stable/c/77d210e8db4d61d43b2d16df66b1ec46fad2ee01 - () https://git.kernel.org/stable/c/77d210e8db4d61d43b2d16df66b1ec46fad2ee01 - Mailing List, Patch
References () https://git.kernel.org/stable/c/7e7a0d86542b0ea903006d3f42f33c4f7ead6918 - () https://git.kernel.org/stable/c/7e7a0d86542b0ea903006d3f42f33c4f7ead6918 - Mailing List, Patch
References () https://git.kernel.org/stable/c/95b1d336b0642198b56836b89908d07b9a0c9608 - () https://git.kernel.org/stable/c/95b1d336b0642198b56836b89908d07b9a0c9608 - Mailing List, Patch
References () https://git.kernel.org/stable/c/98fee5bee97ad47b527a997d5786410430d1f0e9 - () https://git.kernel.org/stable/c/98fee5bee97ad47b527a997d5786410430d1f0e9 - Mailing List, Patch
References () https://git.kernel.org/stable/c/9a9ab0d963621d9d12199df9817e66982582d5a5 - () https://git.kernel.org/stable/c/9a9ab0d963621d9d12199df9817e66982582d5a5 - Mailing List, Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html - Mailing List
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html - Mailing List
First Time Linux
Linux linux Kernel
Debian debian Linux
Debian
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7

21 Nov 2024, 08:40

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html -
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
References () https://git.kernel.org/stable/c/252a2a5569eb9f8d16428872cc24dea1ac0bb097 - () https://git.kernel.org/stable/c/252a2a5569eb9f8d16428872cc24dea1ac0bb097 -
References () https://git.kernel.org/stable/c/6696f76c32ff67fec26823fc2df46498e70d9bf3 - () https://git.kernel.org/stable/c/6696f76c32ff67fec26823fc2df46498e70d9bf3 -
References () https://git.kernel.org/stable/c/67f16bf2cc1698fd50e01ee8a2becc5a8e6d3a3e - () https://git.kernel.org/stable/c/67f16bf2cc1698fd50e01ee8a2becc5a8e6d3a3e -
References () https://git.kernel.org/stable/c/77d210e8db4d61d43b2d16df66b1ec46fad2ee01 - () https://git.kernel.org/stable/c/77d210e8db4d61d43b2d16df66b1ec46fad2ee01 -
References () https://git.kernel.org/stable/c/7e7a0d86542b0ea903006d3f42f33c4f7ead6918 - () https://git.kernel.org/stable/c/7e7a0d86542b0ea903006d3f42f33c4f7ead6918 -
References () https://git.kernel.org/stable/c/95b1d336b0642198b56836b89908d07b9a0c9608 - () https://git.kernel.org/stable/c/95b1d336b0642198b56836b89908d07b9a0c9608 -
References () https://git.kernel.org/stable/c/98fee5bee97ad47b527a997d5786410430d1f0e9 - () https://git.kernel.org/stable/c/98fee5bee97ad47b527a997d5786410430d1f0e9 -
References () https://git.kernel.org/stable/c/9a9ab0d963621d9d12199df9817e66982582d5a5 - () https://git.kernel.org/stable/c/9a9ab0d963621d9d12199df9817e66982582d5a5 -

04 Nov 2024, 13:16

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

27 Jun 2024, 12:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -

25 Jun 2024, 21:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: binder: corrige la ejecución entre mmput() y do_exit() La tarea A llama a binder_update_page_range() para asignar e insertar páginas en un espacio de direcciones remoto desde la tarea B. Para esto, la tarea A fija el mm remoto a través de mmget_not_zero() primero. Esto puede competir con la Tarea B do_exit() y la disminución final del recuento de mmput() provendrá de la Tarea A. Tarea A | Tarea B ------------------+------------------ mmget_not_zero() | | hacer_salir() | salida_mm() | mmput() mmput() | salida_mmap() | eliminar_vma() | salida() | En este caso, el trabajo de ____fput() de la Tarea B se pone en cola en la Tarea A como TWA_RESUME. Entonces, en teoría, la Tarea A regresa al espacio de usuario y se ejecuta el trabajo de limpieza. Sin embargo, la Tarea A duerme, esperando una respuesta de la Tarea B que nunca llega (está muerta). Esto significa que binder_deferred_release() está bloqueado hasta que un evento de carpeta no relacionado obligue a la Tarea A a regresar al espacio de usuario. Todas las notificaciones de defunción asociadas también se retrasarán hasta entonces. Para solucionar este problema, utilice mmput_async() que programará el trabajo en el mm->async_put_work WQ correspondiente en lugar de la Tarea A.

18 Mar 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-18 11:15

Updated : 2025-03-10 15:10

NVD link : CVE-2023-52609

Mitre link : CVE-2023-52609

CVE.ORG link : CVE-2023-52609

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')