CVE-2023-52469: drivers/amd/pm: fix a use-after-free in kv_parse_power_table
In the Linux kernel, the following vulnerability has been resolved:
drivers/amd/pm: fix a use-after-free in kvparsepowertable
When ps allocated by kzalloc equals to NULL, kvparsepowertable frees adev->pm.dpm.ps that allocated before. However, after the control flow goes through the following call chains:
kvparsepowertable |-> kvdpminit |-> kvdpmswinit |-> kvdpmfini
The adev->pm.dpm.ps is used in the for loop of kvdpmfini after its first free in kvparsepowertable and causes a use-after-free bug.
Other sources
Linux Kernel is vulnerable to a denial of service, caused by a use-after-free in kvparsepowertable. A local attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52469?
CVE-2023-52469 has been classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2023-52469?
To fix CVE-2023-52469, upgrade your Linux kernel to a version that is not affected, such as 5.10.223-1 or later.
What versions of the Linux kernel are affected by CVE-2023-52469?
CVE-2023-52469 affects Linux kernel versions between 4.2.0 and 6.7.2.
What is a use-after-free vulnerability in the context of CVE-2023-52469?
A use-after-free vulnerability like CVE-2023-52469 occurs when memory is freed but still accessed, potentially leading to crashes or arbitrary code execution.
Is there a public exploit for CVE-2023-52469?
As of now, there are no confirmed public exploits available for CVE-2023-52469.