In the Linux kernel, the following vulnerability has been resolved:
virtio-mmio: don't break lifecycle of vm_dev
vm_dev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is correct.
Allocating the vmdev struct with devres totally breaks this protection, though. Instead of waiting for the vmdev release callback, the memory is freed when the platform_device is removed. Resulting in a use-after-free when finally the callback is to be called.
To easily see the problem, compile the kernel with CONFIGDEBUGKOBJECT_RELEASE and unbind with sysfs.
The fix is easy, don't use devres in this case.
Found during my research about object lifetime problems.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53515.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53515.json"
[
{
"target": {
"file": "drivers/virtio/virtio_mmio.c"
},
"digest": {
"line_hashes": [
"319578568716501398532267647616117542645",
"85969695136420739456976126442665030140",
"209982824290956885849302876257458620917",
"253152397841962132114337313233067370643",
"246655931474902869185150311251592087852",
"274075462711359354750025198616511043770",
"96298917170824376606541942126341737477",
"51541175451663900967676041253486605941",
"267305404462537409034210517152188280957"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53515-1043f64b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ff54d904fafabd0912796785e53cce4e69ca123",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c",
"function": "virtio_mmio_probe"
},
"digest": {
"length": 1782.0,
"function_hash": "150110502363744961284637806679824732140"
},
"signature_type": "Function",
"id": "CVE-2023-53515-1eacdd4f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ff54d904fafabd0912796785e53cce4e69ca123",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c"
},
"digest": {
"line_hashes": [
"319578568716501398532267647616117542645",
"85969695136420739456976126442665030140",
"209982824290956885849302876257458620917",
"253152397841962132114337313233067370643",
"246655931474902869185150311251592087852",
"274075462711359354750025198616511043770",
"96298917170824376606541942126341737477",
"51541175451663900967676041253486605941",
"267305404462537409034210517152188280957"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53515-28ca00b4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55c91fedd03d7b9cf0c5199b2eb12b9b8e95281a",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c",
"function": "virtio_mmio_release_dev"
},
"digest": {
"length": 222.0,
"function_hash": "56949092468841451988555493750807768346"
},
"signature_type": "Function",
"id": "CVE-2023-53515-3cb0039b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2dcb368fe5a8eee498ca75c93a18ce2f3b0d6a8e",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c"
},
"digest": {
"line_hashes": [
"319578568716501398532267647616117542645",
"85969695136420739456976126442665030140",
"209982824290956885849302876257458620917",
"253152397841962132114337313233067370643",
"246655931474902869185150311251592087852",
"274075462711359354750025198616511043770",
"96298917170824376606541942126341737477",
"51541175451663900967676041253486605941",
"267305404462537409034210517152188280957"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53515-3d3f562b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af5818c35173e096085c6ae2e3aac605d3d15e41",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c",
"function": "virtio_mmio_release_dev"
},
"digest": {
"length": 222.0,
"function_hash": "56949092468841451988555493750807768346"
},
"signature_type": "Function",
"id": "CVE-2023-53515-4b74afe0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b788ad3b2468512339c05f23692e36860264e674",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c",
"function": "virtio_mmio_release_dev"
},
"digest": {
"length": 222.0,
"function_hash": "56949092468841451988555493750807768346"
},
"signature_type": "Function",
"id": "CVE-2023-53515-509de82a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b7d5c2dd664eb8b9a06ecbc06e28d39359c422e",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c",
"function": "virtio_mmio_probe"
},
"digest": {
"length": 1782.0,
"function_hash": "150110502363744961284637806679824732140"
},
"signature_type": "Function",
"id": "CVE-2023-53515-58b8dbd0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af5818c35173e096085c6ae2e3aac605d3d15e41",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c",
"function": "virtio_mmio_release_dev"
},
"digest": {
"length": 222.0,
"function_hash": "56949092468841451988555493750807768346"
},
"signature_type": "Function",
"id": "CVE-2023-53515-58eb7aa7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55c91fedd03d7b9cf0c5199b2eb12b9b8e95281a",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c",
"function": "virtio_mmio_probe"
},
"digest": {
"length": 1782.0,
"function_hash": "150110502363744961284637806679824732140"
},
"signature_type": "Function",
"id": "CVE-2023-53515-66c75819",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b788ad3b2468512339c05f23692e36860264e674",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c",
"function": "virtio_mmio_release_dev"
},
"digest": {
"length": 222.0,
"function_hash": "56949092468841451988555493750807768346"
},
"signature_type": "Function",
"id": "CVE-2023-53515-6dcb2cc5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ff54d904fafabd0912796785e53cce4e69ca123",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c"
},
"digest": {
"line_hashes": [
"319578568716501398532267647616117542645",
"85969695136420739456976126442665030140",
"209982824290956885849302876257458620917",
"253152397841962132114337313233067370643",
"246655931474902869185150311251592087852",
"274075462711359354750025198616511043770",
"96298917170824376606541942126341737477",
"51541175451663900967676041253486605941",
"267305404462537409034210517152188280957"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53515-790cfe65",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@97a2d55ead76358245b446efd87818e919196d7a",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c",
"function": "virtio_mmio_release_dev"
},
"digest": {
"length": 222.0,
"function_hash": "56949092468841451988555493750807768346"
},
"signature_type": "Function",
"id": "CVE-2023-53515-926fe186",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@97a2d55ead76358245b446efd87818e919196d7a",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c",
"function": "virtio_mmio_release_dev"
},
"digest": {
"length": 222.0,
"function_hash": "56949092468841451988555493750807768346"
},
"signature_type": "Function",
"id": "CVE-2023-53515-a76e25c6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af5818c35173e096085c6ae2e3aac605d3d15e41",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c",
"function": "virtio_mmio_probe"
},
"digest": {
"length": 1782.0,
"function_hash": "150110502363744961284637806679824732140"
},
"signature_type": "Function",
"id": "CVE-2023-53515-a807632a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b7d5c2dd664eb8b9a06ecbc06e28d39359c422e",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c"
},
"digest": {
"line_hashes": [
"319578568716501398532267647616117542645",
"85969695136420739456976126442665030140",
"209982824290956885849302876257458620917",
"253152397841962132114337313233067370643",
"246655931474902869185150311251592087852",
"274075462711359354750025198616511043770",
"96298917170824376606541942126341737477",
"51541175451663900967676041253486605941",
"267305404462537409034210517152188280957"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53515-b1722a53",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b788ad3b2468512339c05f23692e36860264e674",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c",
"function": "virtio_mmio_probe"
},
"digest": {
"length": 1782.0,
"function_hash": "150110502363744961284637806679824732140"
},
"signature_type": "Function",
"id": "CVE-2023-53515-c127b390",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55c91fedd03d7b9cf0c5199b2eb12b9b8e95281a",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c",
"function": "virtio_mmio_probe"
},
"digest": {
"length": 1782.0,
"function_hash": "150110502363744961284637806679824732140"
},
"signature_type": "Function",
"id": "CVE-2023-53515-d1da6b19",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2dcb368fe5a8eee498ca75c93a18ce2f3b0d6a8e",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c"
},
"digest": {
"line_hashes": [
"319578568716501398532267647616117542645",
"85969695136420739456976126442665030140",
"209982824290956885849302876257458620917",
"253152397841962132114337313233067370643",
"246655931474902869185150311251592087852",
"274075462711359354750025198616511043770",
"96298917170824376606541942126341737477",
"51541175451663900967676041253486605941",
"267305404462537409034210517152188280957"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53515-d7ce8f96",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2dcb368fe5a8eee498ca75c93a18ce2f3b0d6a8e",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c",
"function": "virtio_mmio_probe"
},
"digest": {
"length": 1782.0,
"function_hash": "150110502363744961284637806679824732140"
},
"signature_type": "Function",
"id": "CVE-2023-53515-e63e5928",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@97a2d55ead76358245b446efd87818e919196d7a",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/virtio/virtio_mmio.c"
},
"digest": {
"line_hashes": [
"319578568716501398532267647616117542645",
"85969695136420739456976126442665030140",
"209982824290956885849302876257458620917",
"253152397841962132114337313233067370643",
"246655931474902869185150311251592087852",
"274075462711359354750025198616511043770",
"96298917170824376606541942126341737477",
"51541175451663900967676041253486605941",
"267305404462537409034210517152188280957"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53515-e9483cf4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b7d5c2dd664eb8b9a06ecbc06e28d39359c422e",
"deprecated": false,
"signature_version": "v1"
}
]