CVE-2023-53613
Description
A use-after-free vulnerability was found in the Linux kernel's device-dax subsystem during mapping object cleanup. When removing a dax region provider, the child dax_mapping objects attempt to free their ID allocator after the parent dev_dax object has already been released. This causes ida_free to operate on freed memory, triggering lockdep warnings and potentially causing crashes or memory corruption, leading to denial of service.
Statement
The device-dax subsystem manages mappings of persistent memory regions. The parent-child relationship between dev_dax instances and their dax_mapping children follows the typical device model pattern: children hold references to parents while registered. However, dax_mapping objects were violating this pattern. When kobject delayed cleanup triggered dax_mapping_release (potentially seconds after the mapping was logically removed), it called ida_free on an ida structure that was part of the now-freed parent dev_dax object. The freed parent's memory could have been reallocated for other purposes, making the ida_free operate on arbitrary data structures. The issue manifests clearly under CONFIG_DEBUG_KOBJECT_RELEASE testing, which delays kobject cleanup to expose such bugs. Under normal conditions it creates a window where use-after-free could occur. The fix ensures dax_mapping holds an explicit reference on its parent that's only dropped during the final release callback.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 7.8 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | High | N/A |
| Integrity Impact | None | High | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Availability,Integrity
Technical Impact: DoS: Crash, Exit, or Restart
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
