CVE-2023-52439

Summary

CVE-2023-52439 is a use-after-free vulnerability affecting the Linux kernel's `uio_open` function (component: nuio). The issue arises when `idev->dev` kobject reference in core-1 is decreased to 1 before core-2 gets the device with `get_device(&idev->dev)`. This results in core-2 performing a use-after-free attack on `idev` after core-1 has freed it with `kfree(idev)`. Additionally, when core-2 releases the device with `uio_release` and puts it back with `put_device(&idev->dev`, `idev` is double-freed. This vulnerability has been mitigated by acquiring `idev` atomically and increasing its reference count with `minor_lock` before decreasing its reference in core-1.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.