CVE-2023-52670

rpmsg: virtio: Free driver_override when rpmsg_remove()

MEDIUM

5.5

CVSS Score

Published: May 17, 2024 at 02:02 PM UTC

Updated: June 17, 2026 at 06:43 AM UTC

2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: rpmsg: virtio: Free driver_override when rpmsg_remove() Free driver_override when rpmsg_remove(), otherwise the following memory leak will occur: unreferenced object 0xffff0000d55d7080 (size 128): comm "kworker/u8:2", pid 56, jiffies 4294893188 (age 214.272s) hex dump (first 32 bytes): 72 70 6d 73 67 5f 6e 73 00 00 00 00 00 00 00 00 rpmsg_ns........ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000009c94c9c1>] __kmem_cache_alloc_node+0x1f8/0x320 [<000000002300d89b>] __kmalloc_node_track_caller+0x44/0x70 [<00000000228a60c3>] kstrndup+0x4c/0x90 [<0000000077158695>] driver_set_override+0xd0/0x164 [<000000003e9c4ea5>] rpmsg_register_device_override+0x98/0x170 [<000000001c0c89a8>] rpmsg_ns_register_device+0x24/0x30 [<000000008bbf8fa2>] rpmsg_probe+0x2e0/0x3ec [<00000000e65a68df>] virtio_dev_probe+0x1c0/0x280 [<00000000443331cc>] really_probe+0xbc/0x2dc [<00000000391064b1>] __driver_probe_device+0x78/0xe0 [<00000000a41c9a5b>] driver_probe_device+0xd8/0x160 [<000000009c3bd5df>] __device_attach_driver+0xb8/0x140 [<0000000043cd7614>] bus_for_each_drv+0x7c/0xd4 [<000000003b929a36>] __device_attach+0x9c/0x19c [<00000000a94e0ba8>] device_initial_probe+0x14/0x20 [<000000003c999637>] bus_probe_device+0xa0/0xac

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

10.0

Linux Kernel · Linux

95%

4.13 ≤ v < 4.19.3074.13 ≤ v < 5.10.2104.13 ≤ v < 5.15.1494.13 ≤ v < 5.4.2694.13 ≤ v < 6.1.764.13 ≤ v < 6.6.154.13 ≤ v < 6.7.34.13 ≤ v < 6.84.20 ≤ v < 5.4.2695.11 ≤ v < 5.15.1495.16 ≤ v < 6.1.765.5 ≤ v < 5.10.2106.2 ≤ v < 6.6.156.7 ≤ v < 6.7.34.13b0b03b811963b0b03b8119633de0649da9bd506e4850c401ff2b

Vendor states this is fixed in 229ce47cbfdc (fixed)

Vendor states this is fixed in 229ce47cbfdc7d3a9415eb676abbfb77d676cb08 (fixed)

Vendor states this is fixed in 2d27a7b19cb3 (fixed)

Vendor states this is fixed in 2d27a7b19cb354c6d04bcdc9239e261ff29858d6 (fixed)

Vendor states this is fixed in 4e6cef3fae5c (fixed)

Vendor states this is fixed in 4e6cef3fae5c164968118a13f3fe293700adc81a (fixed)

Vendor states this is fixed in 69ca89d80f2c (fixed)

Vendor states this is fixed in 69ca89d80f2c8a1f5af429b955637beea7eead30 (fixed)

Vendor states this is fixed in 9a416d624e5f (fixed)

Vendor states this is fixed in 9a416d624e5fb7246ea97c11fbfea7e0e27abf43 (fixed)

Vendor states this is fixed in d5362c37e1f8 (fixed)

Vendor states this is fixed in d5362c37e1f8a40096452fc201c30e705750e687 (fixed)

Vendor states this is fixed in dd50fe18c234 (fixed)

Vendor states this is fixed in dd50fe18c234bd5ff22f658f4d414e8fa8cd6a5d (fixed)

Vendor states this is fixed in f4bb1d5daf77 (fixed)

Vendor states this is fixed in f4bb1d5daf77b1a95a43277268adf0d1430c2346 (fixed)

Vendor states this is fixed in 4.13 (unaffected)

Vendor states this is fixed in 4.19.307 (unaffected)

Vendor states this is fixed in 5.10.210 (unaffected)

Vendor states this is fixed in 5.15.149 (unaffected)

Vendor states this is fixed in 5.4.269 (unaffected)

Vendor states this is fixed in 5.4269 (unaffected)

Vendor states this is fixed in 6.1.76 (unaffected)

Vendor states this is fixed in 6.6.15 (unaffected)

Vendor states this is fixed in 6.7.3 (unaffected)

Vendor states this is fixed in 6.73 (unaffected)

Vendor states this is fixed in 6.8 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references