CVE-2023-52907
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-52907
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-52907.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-52907
- Downstream
- Related
- Published
- 2024-08-21T07:15:06Z
- Modified
- 2025-07-01T15:20:37.266972Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
nfc: pn533: Wait for outurb's completion in pn533usbsendframe()
Fix a use-after-free that occurs in hcd when inurb sent from pn533usbsendframe() is completed earlier than outurb. Its callback frees the skb data in pn533sendasynccomplete() that is used as a transfer buffer of outurb. Wait before sending inurb until the callback of outurb is called. To modify the callback of outurb alone, separate the complete function of outurb and ackurb.
Found by a modified version of syzkaller.
BUG: KASAN: use-after-free in dummytimer Call Trace: memcpy (mm/kasan/shadow.c:65) dummyperformtransfer (drivers/usb/gadget/udc/dummyhcd.c:1352) transfer (drivers/usb/gadget/udc/dummyhcd.c:1453) dummytimer (drivers/usb/gadget/udc/dummyhcd.c:1972) archstaticbranch (arch/x86/include/asm/jumplabel.h:27) statickeyfalse (include/linux/jumplabel.h:207) timerexpireexit (include/trace/events/timer.h:127) calltimerfn (kernel/time/timer.c:1475) expiretimers (kernel/time/timer.c:1519) _runtimers (kernel/time/timer.c:1790) runtimersoftirq (kernel/time/timer.c:1803)
- References
-
- https://git.kernel.org/stable/c/0ca78c99656f5c448567db1e148367aa3b01c80a
- https://git.kernel.org/stable/c/321db5131c92983dac4f3338e8fbb6df214238c0
- https://git.kernel.org/stable/c/35529d6b827eedb6bf7e81130e4b7e0aba9e58d2
- https://git.kernel.org/stable/c/39ae73e581112cfe27ba50aecb1c891ce57cecb1
- https://git.kernel.org/stable/c/8998db5021a28ad67aa8d627bdb4226e4046ccc4
- https://git.kernel.org/stable/c/9424d2205fe94a095fb9365ec0c6137f0b394a2b
- https://git.kernel.org/stable/c/9dab880d675b9d0dd56c6428e4e8352a3339371d
- https://security-tracker.debian.org/tracker/CVE-2023-52907
Affected packages
Debian:11 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.10.178-1
Affected versions
5.*
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source