Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2023-53308

net: fec: Better handle pm_runtime_get() failing in .remove()

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 4.14.316, 4.19.284, 4.10, 5.4
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: net: fec: Better handle pm_runtime_get() failing in .remove() In the (unlikely) event that pm_runtime_get() (disguised as pm_runtime_resume_and_get()) fails, the remove callback returned an error early. The problem with this is that the driver core ignores the error value and continues removing the device. This results in a resource leak. Worse the devm allocated resources are freed and so if a callback of the driver is called later the register mapping is already gone which probably results in a crash.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 4.14.158 · fixed in 4.14.316; From 4.19.88 · fixed in 4.19.284; From 4.9.206 · fixed in 4.10; From 5.3.15 · fixed in 5.4

  • Linux Linux

    5.4

References 8

git.kernel.org