CVE-2023-52457

Summary

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed

Returning an error code from .remove() makes the driver core emit the little helpful error message:

remove callback returned a non-zero value. This will be ignored.

and then remove the device anyhow. So all resources that were not freed are leaked in this case. Skipping serial8250_unregister_port() has the potential to keep enough of the UART around to trigger a use-after-free.

So replace the error return (and with it the little helpful error message) by a more useful error message and continue to cleanup.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux2d66412563ef8953e2bac2d98d2d832b3f3f49cd < b502fb43f7fb55aaf07f6092ab44657595214b93affected
LinuxLinuxd833cba201adf9237168e19f0d76e4d7aa69f303 < bc57f3ef8a9eb0180606696f586a6dcfaa175ed0affected
LinuxLinuxe0db709a58bdeb8966890882261a3f8438c5c9b7 < 828cd829483f0cda920710997aed79130b0af690affected
LinuxLinuxe3f0c638f428fd66b5871154b62706772045f91a < d74173bda29aba58f822175d983d07c8ed335494affected
LinuxLinuxe3f0c638f428fd66b5871154b62706772045f91a < 887a558d0298d36297daea039954c39940228d9baffected
LinuxLinuxe3f0c638f428fd66b5871154b62706772045f91a < 95e4e0031effad9837af557ecbfd4294a4d8aeeeaffected
LinuxLinuxe3f0c638f428fd66b5871154b62706772045f91a < ad90d0358bd3b4554f243a425168fc7cebe7d04eaffected
LinuxLinux02eed6390dbe61115f3e3f63829c95c611aee67baffected
LinuxLinux5.4.225 < 5.4.268affected
LinuxLinux5.10.156 < 5.10.209affected
LinuxLinux5.15.80 < 5.15.148affected
LinuxLinux6.0.10 < 6.1affected
LinuxLinux6.1affected
LinuxLinux0 < 6.1unaffected
LinuxLinux5.4.268 <= 5.4.*unaffected
LinuxLinux5.10.209 <= 5.10.*unaffected
LinuxLinux5.15.148 <= 5.15.*unaffected
LinuxLinux6.1.75 <= 6.1.*unaffected
LinuxLinux6.6.14 <= 6.6.*unaffected
LinuxLinux6.7.2 <= 6.7.*unaffected
LinuxLinux6.8 <= *unaffected

Weaknesses

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References