201 lines
12 KiB
JSON
201 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2023-53572",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-10-04T15:14:15.925Z",
|
|
"datePublished": "2025-10-04T15:17:13.089Z",
|
|
"dateUpdated": "2026-08-05T09:14:54.320Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T09:14:54.320Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: imx: scu: use _safe list iterator to avoid a use after free\n\nThis loop is freeing \"clk\" so it needs to use list_for_each_entry_safe().\nOtherwise it dereferences a freed variable to get the next item on the\nloop."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The defect is in the i.MX8QXP/QM/DXL SCU platform clock-provider probe path (`imx8qxp_clk_probe()` → `imx_clk_scu_unregister()`), entered only through the local OF/device-driver model; no network, adjacent-network, or remote-peer data reaches a clock registration routine, and even the hypothetical re-entry routes (module load, DT overlay) require local system access.\nAC:H - The error branch is only taken when `of_clk_add_hw_provider()` fails, which after ruling out `of_clk_set_defaults()` (no in-tree i.MX8 SCU DT node carries `assigned-clocks`/`assigned-clock-rates`) reduces to a ~40-byte GFP_KERNEL `kzalloc()` failing during boot-time probe — small GFP_KERNEL allocations retry and OOM-kill rather than fail, and an attacker cannot induce memory pressure inside the boot-time probe window, so the precondition is genuinely outside attacker control.\nPR:L - There is no capability check anywhere along the path itself and the memory-pressure condition that would provoke the allocation failure needs no privilege at all; although the only explicit re-probe triggers (module load, DTB/overlay) are root-gated and `suppress_bind_attrs = true` removes the sysfs bind route, the uncertainty is resolved toward the lower privilege bar rather than PR:H.\nUI:N - The use-after-free fires automatically inside the driver's own probe error unwind; no administrator or victim must mount a filesystem, open a device, or take any other action for the freed-list walk to execute.\nS:U - The freed slab object, the wild pointer dereference, and the resulting corruption are all confined to kernel heap and the clk framework's own bookkeeping within a single security authority; no VM, container, IOMMU, or sandbox boundary is crossed.\nC:H - This is a genuine use-after-free read: `clk->node.next` is read from a kmalloc-64 object already returned to the allocator with no lock held, so a concurrently reallocated occupant's contents are consumed as a list pointer and its `clk->hw` field is dereferenced by `clk_unregister()`, which additionally prints `clk->core->name` from that wild pointer to dmesg via `pr_err`/`pr_warn` — per kernel UAF treatment this warrants High.\nI:H - Once the loop follows a stale or reallocated `next` pointer, `clk_hw_unregister()` → `clk_unregister()` performs out-of-lifetime writes through it (`clk->core->ops = &clk_nodrv_ops`, `hlist_del_init()`, `kref_put()`), and the loop body then `kfree()`s that attacker-influenceable address — an arbitrary-free plus wild-write primitive suitable for control-flow-relevant heap corruption.\nA:H - With `init_on_free` the freed `node.next` reads back as NULL and with SLUB poisoning as 0x6b6b..., either way oopsing immediately, and a reallocated object yields wild-pointer dereferences and freelist corruption during boot — on the embedded/automotive i.MX8QXP/QM boards this driver targets, commonly booted with panic_on_oops, that leaves the board unbootable."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/clk/imx/clk-scu.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
|
|
"lessThan": "f95ff838ac39f861d1f95a0f3bbb1e01c2517d79",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
|
|
"lessThan": "08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
|
|
"lessThan": "3d90921f91fc6a8c801d527bb5848c99e335c1cf",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
|
|
"lessThan": "0a719f0e4b6f233979e219baff73923e76a96e09",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
|
|
"lessThan": "632c60ecd25dbacee54d5581fe3aeb834b57010a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/clk/imx/clk-scu.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.11",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.11",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.121",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.39",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.3.13",
|
|
"lessThanOrEqual": "6.3.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.4.4",
|
|
"lessThanOrEqual": "6.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.5",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.11",
|
|
"versionEndExcluding": "5.15.121"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.11",
|
|
"versionEndExcluding": "6.1.39"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.11",
|
|
"versionEndExcluding": "6.3.13"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.11",
|
|
"versionEndExcluding": "6.4.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.11",
|
|
"versionEndExcluding": "6.5"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f95ff838ac39f861d1f95a0f3bbb1e01c2517d79"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3d90921f91fc6a8c801d527bb5848c99e335c1cf"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0a719f0e4b6f233979e219baff73923e76a96e09"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/632c60ecd25dbacee54d5581fe3aeb834b57010a"
|
|
}
|
|
],
|
|
"title": "clk: imx: scu: use _safe list iterator to avoid a use after free",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |