CVE-2023-53515
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2023
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
virtio-mmio: don't break lifecycle of vm_dev
In the Linux kernel, the following vulnerability has been resolved: virtio-mmio: don't break lifecycle of vm_dev vm_dev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is correct. Allocating the vm_dev struct with devres totally breaks this protection, though. Instead of waiting for the vm_dev release callback, the memory is freed when the platform_device is removed. Resulting in a use-after-free when finally the callback is to be called. To easily see the problem, compile the kernel with CONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs. The fix is easy, don't use devres in this case. Found during my research about object lifetime problems.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5 | affected | git | 97a2d55ead76358245b446efd87818e919196d7a | Unavailable | None listed |
| 7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5 | affected | git | b788ad3b2468512339c05f23692e36860264e674 | Unavailable | None listed |
| 7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5 | affected | git | 3ff54d904fafabd0912796785e53cce4e69ca123 | Unavailable | None listed |
| 7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5 | affected | git | 5b7d5c2dd664eb8b9a06ecbc06e28d39359c422e | Unavailable | None listed |
| 7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5 | affected | git | af5818c35173e096085c6ae2e3aac605d3d15e41 | Unavailable | None listed |
| 7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5 | affected | git | 2dcb368fe5a8eee498ca75c93a18ce2f3b0d6a8e | Unavailable | None listed |
| 7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5 | affected | git | 55c91fedd03d7b9cf0c5199b2eb12b9b8e95281a | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 4.15 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 4.15 | Unavailable | None listed |
| 4.19.293 | unaffected | semver | Unavailable | 4.19.* | None listed |
| 5.4.255 | unaffected | semver | Unavailable | 5.4.* | None listed |
| 5.10.192 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.128 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.47 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.4.12 | unaffected | semver | Unavailable | 6.4.* | None listed |
| 6.5 | unaffected | original_commit_for_fix | Unavailable | * | None listed |