CVE-2023-52629

In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug The original code puts flush_work() before timer_shutdown_sync() in switch_drv_remove(). Although we use flush_work() to stop the worker, it could be rescheduled in switch_timer(). As a result, a use-after-free bug can occur. The details are shown below: (cpu 0) | (cpu 1) switch_drv_remove() | flush_work() | ... | switch_timer // timer | schedule_work(&psw->work) timer_shutdown_sync() | ... | switch_work_handler // worker kfree(psw) // free | | psw->state = 0 // use This patch puts timer_shutdown_sync() before flush_work() to mitigate the bugs. As a result, the worker and timer will be stopped safely before the deallocate operations.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/246f80a0b17f8f582b2c0996db02998239057c65	Patch
https://git.kernel.org/stable/c/610dbd8ac271aa36080aac50b928d700ee3fe4de	Patch
https://git.kernel.org/stable/c/ff635d1f143b55fa005e9e43b16e6d8f677e90a5
https://git.kernel.org/stable/c/246f80a0b17f8f582b2c0996db02998239057c65	Patch
https://git.kernel.org/stable/c/610dbd8ac271aa36080aac50b928d700ee3fe4de	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

History

03 Oct 2026, 11:17

Type	Values Removed	Values Added
References		() https://git.kernel.org/stable/c/ff635d1f143b55fa005e9e43b16e6d8f677e90a5 -

Information

Published : 2024-03-29 10:15

Updated : 2026-10-03 11:17

NVD link : CVE-2023-52629

Mitre link : CVE-2023-52629

CVE.ORG link : CVE-2023-52629

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-416

Use After Free

{"id": "CVE-2023-52629", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-52629", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2024-04-01T17:41:22.649775Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9f5e8eee5cfe1328660c71812d87c2a67bda389f", "lessThan": "ff635d1f143b55fa005e9e43b16e6d8f677e90a5", "versionType": "git"}, {"status": "affected", "version": "9f5e8eee5cfe1328660c71812d87c2a67bda389f", "lessThan": "610dbd8ac271aa36080aac50b928d700ee3fe4de", "versionType": "git"}, {"status": "affected", "version": "9f5e8eee5cfe1328660c71812d87c2a67bda389f", "lessThan": "246f80a0b17f8f582b2c0996db02998239057c65", "versionType": "git"}], "programFiles": ["arch/sh/drivers/push-switch.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.20"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.20", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.189", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.5.4", "versionType": "semver", "lessThanOrEqual": "6.5.*"}, {"status": "unaffected", "version": "6.6", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/sh/drivers/push-switch.c"], "defaultStatus": "affected"}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "affectedData": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "9f5e8eee5cfe", "lessThan": "610dbd8ac271", "versionType": "custom"}, {"status": "affected", "version": "9f5e8eee5cfe", "lessThan": "246f80a0b17f", "versionType": "custom"}, {"status": "affected", "version": "2.6.20"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.20", "versionType": "custom"}, {"status": "unaffected", "version": "6.54", "versionType": "custom", "lessThanOrEqual": "6.6"}, {"status": "unaffected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.6"}], "defaultStatus": "unknown"}]}], "published": "2024-03-29T10:15:09.327", "references": [{"url": "https://git.kernel.org/stable/c/246f80a0b17f8f582b2c0996db02998239057c65", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/610dbd8ac271aa36080aac50b928d700ee3fe4de", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ff635d1f143b55fa005e9e43b16e6d8f677e90a5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/246f80a0b17f8f582b2c0996db02998239057c65", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://git.kernel.org/stable/c/610dbd8ac271aa36080aac50b928d700ee3fe4de", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsh: push-switch: Reorder cleanup operations to avoid use-after-free bug\n\nThe original code puts flush_work() before timer_shutdown_sync()\nin switch_drv_remove(). Although we use flush_work() to stop\nthe worker, it could be rescheduled in switch_timer(). As a result,\na use-after-free bug can occur. The details are shown below:\n\n (cpu 0) | (cpu 1)\nswitch_drv_remove() |\n flush_work() |\n ... | switch_timer // timer\n | schedule_work(&psw->work)\n timer_shutdown_sync() |\n ... | switch_work_handler // worker\n kfree(psw) // free |\n | psw->state = 0 // use\n\nThis patch puts timer_shutdown_sync() before flush_work() to\nmitigate the bugs. As a result, the worker and timer will be\nstopped safely before the deallocate operations."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sh: push-switch: reordenar las operaciones de limpieza para evitar el error de use after free. El c\u00f3digo original coloca Flush_work() antes de timer_shutdown_sync() en switch_drv_remove(). Aunque usamos Flush_work() para detener al trabajador, podr\u00eda reprogramarse en switch_timer(). Como resultado, puede ocurrir un error de use after free. Los detalles se muestran a continuaci\u00f3n: (cpu 0) | (procesador 1) switch_drv_remove() | descarga_trabajo() | ... | switch_timer // temporizador | Schedule_work(&psw->trabajo) timer_shutdown_sync() | ... | switch_work_handler // trabajador kfree(psw) // gratis | | psw->state = 0 // uso Este parche coloca timer_shutdown_sync() antes de Flush_work() para mitigar los errores. Como resultado, el trabajador y el temporizador se detendr\u00e1n de forma segura antes de las operaciones de desasignaci\u00f3n."}], "lastModified": "2026-10-03T11:17:26.973", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5A8752DF-35F4-4DE7-AC4E-3F753EDE78B3", "versionEndExcluding": "6.5.4", "versionStartIncluding": "2.6.20"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}