CVE-2023-52907

Source
https://nvd.nist.gov/vuln/detail/CVE-2023-52907
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-52907.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-52907
Downstream
Related
Published
2024-08-21T07:15:06Z
Modified
2025-08-09T20:01:28Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

nfc: pn533: Wait for outurb's completion in pn533usbsendframe()

Fix a use-after-free that occurs in hcd when inurb sent from pn533usbsendframe() is completed earlier than outurb. Its callback frees the skb data in pn533sendasynccomplete() that is used as a transfer buffer of outurb. Wait before sending inurb until the callback of outurb is called. To modify the callback of outurb alone, separate the complete function of outurb and ackurb.

Found by a modified version of syzkaller.

BUG: KASAN: use-after-free in dummytimer Call Trace: memcpy (mm/kasan/shadow.c:65) dummyperformtransfer (drivers/usb/gadget/udc/dummyhcd.c:1352) transfer (drivers/usb/gadget/udc/dummyhcd.c:1453) dummytimer (drivers/usb/gadget/udc/dummyhcd.c:1972) archstaticbranch (arch/x86/include/asm/jumplabel.h:27) statickeyfalse (include/linux/jumplabel.h:207) timerexpireexit (include/trace/events/timer.h:127) calltimerfn (kernel/time/timer.c:1475) expiretimers (kernel/time/timer.c:1519) _runtimers (kernel/time/timer.c:1790) runtimersoftirq (kernel/time/timer.c:1803)

References

Affected packages