329 lines
16 KiB
JSON
329 lines
16 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2023-52871",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2024-05-21T15:19:24.263Z",
|
||
"datePublished": "2024-05-21T15:32:00.922Z",
|
||
"dateUpdated": "2026-08-05T09:11:45.186Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T09:11:45.186Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: llcc: Handle a second device without data corruption\n\nUsually there is only one llcc device. But if there were a second, even\na failed probe call would modify the global drv_data pointer. So check\nif drv_data is valid before overwriting it."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
|
||
"baseScore": 7.1,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:L - The vulnerable code is qcom_llcc_probe in the Qualcomm LLCC platform driver, reached only via device-tree platform device probe or local sysfs driver bind—not via network packets or remote protocols.\nAC:L - Once a second matching LLCC platform device is instantiated, probe unconditionally overwrites the global drv_data pointer and the failure path sets ERR_PTR(-ENODEV), so corruption is deterministic with no race or luck required.\nPR:L - Exploitation requires local ability to cause a second matching platform device to probe (crafted DT/overlay or driver bind on Qualcomm platforms); this is scored as low privileges under the higher-severity rule rather than requiring fully privileged root-only admin.\nUI:N - No victim interaction is needed; the corruption occurs entirely during kernel probe of the second device and can fault when existing in-kernel clients use LLCC.\nS:U - Impact stays within the host kernel’s security authority (driver state and system-cache configuration); there is no VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:N - The bug overwrites a global driver pointer and can cause crashes or wrong MMIO programming, but it does not provide an information-disclosure or memory-read primitive.\nI:H - A second probe reliably corrupts the global drv_data used for all LLCC operations and can reprogram system-cache slice configuration registers, which is high-integrity impact as described in the fix (“data corruption”).\nA:H - While the global points at a zeroed allocation mid-probe, clients such as a6xx_llc_activate call llcc_slice_activate and dereference NULL bcast_regmap/bitmap, causing a kernel oops/panic."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/soc/qcom/llcc-qcom.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "a3134fb09e0bc5bee76e13bf863173b86f21cf87",
|
||
"lessThan": "cc1a1dcb411fe224f48553cfdcdfe6e61395b69c",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "a3134fb09e0bc5bee76e13bf863173b86f21cf87",
|
||
"lessThan": "5e5b85ea0f4bc484bfe4cc73ead51fa48d2366a0",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "a3134fb09e0bc5bee76e13bf863173b86f21cf87",
|
||
"lessThan": "995ee1e84e8db7fa5dcdde7dfe0bd7bb6f9bbb8c",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "a3134fb09e0bc5bee76e13bf863173b86f21cf87",
|
||
"lessThan": "f0ef883cae309bc5e8cdfcdbc1b4822732ce20a8",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "a3134fb09e0bc5bee76e13bf863173b86f21cf87",
|
||
"lessThan": "3565684309e54fa998ea27f37028d67cc3e1dff2",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "a3134fb09e0bc5bee76e13bf863173b86f21cf87",
|
||
"lessThan": "1143bfb9b055897975aeaea254da148e19524493",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "a3134fb09e0bc5bee76e13bf863173b86f21cf87",
|
||
"lessThan": "f1a1bc8775b26345aba2be278118999e7f661d3d",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/soc/qcom/llcc-qcom.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "4.19",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "4.19",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.4.261",
|
||
"lessThanOrEqual": "5.4.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.201",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.139",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.1.63",
|
||
"lessThanOrEqual": "6.1.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.5.12",
|
||
"lessThanOrEqual": "6.5.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.6.2",
|
||
"lessThanOrEqual": "6.6.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.7",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.19",
|
||
"versionEndExcluding": "5.4.261"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.19",
|
||
"versionEndExcluding": "5.10.201"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.19",
|
||
"versionEndExcluding": "5.15.139"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.19",
|
||
"versionEndExcluding": "6.1.63"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.19",
|
||
"versionEndExcluding": "6.5.12"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.19",
|
||
"versionEndExcluding": "6.6.2"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.19",
|
||
"versionEndExcluding": "6.7"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/cc1a1dcb411fe224f48553cfdcdfe6e61395b69c"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/5e5b85ea0f4bc484bfe4cc73ead51fa48d2366a0"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/995ee1e84e8db7fa5dcdde7dfe0bd7bb6f9bbb8c"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/f0ef883cae309bc5e8cdfcdbc1b4822732ce20a8"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/3565684309e54fa998ea27f37028d67cc3e1dff2"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/1143bfb9b055897975aeaea254da148e19524493"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/f1a1bc8775b26345aba2be278118999e7f661d3d"
|
||
}
|
||
],
|
||
"title": "soc: qcom: llcc: Handle a second device without data corruption",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"title": "CISA ADP Vulnrichment",
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2023-52871",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2024-05-21T18:17:57.620656Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-06-04T17:22:42.515Z"
|
||
}
|
||
},
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-02T23:11:36.044Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/cc1a1dcb411fe224f48553cfdcdfe6e61395b69c",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/5e5b85ea0f4bc484bfe4cc73ead51fa48d2366a0",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/995ee1e84e8db7fa5dcdde7dfe0bd7bb6f9bbb8c",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/f0ef883cae309bc5e8cdfcdbc1b4822732ce20a8",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/3565684309e54fa998ea27f37028d67cc3e1dff2",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/1143bfb9b055897975aeaea254da148e19524493",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/f1a1bc8775b26345aba2be278118999e7f661d3d",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
} |