Strix
26.1K

CVE-2023-53746

UnknownEPSS 0.16%

Last modified

CVE-2023-53746 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix memory leak in vfio_ap device driver The device release callback function invoked to release the matrix device uses the dev_get_drvdata(device *dev) function to retrieve the pointer to the vfio_matrix_dev object in order to free its storage. The problem is, this object is not stored as drvdata with the device; since the kfree function will accept a NULL pointer, the memory for the vfio_matrix_dev object is never freed. Since the device being released is contained within the vfio_matrix_dev object, the container_of macro will be used to retrieve its pointer.. EPSS estimates a 0.16% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix memory leak in vfio_ap device driver The device release callback function invoked to release the matrix device uses the dev_get_drvdata(device *dev) function to retrieve the pointer to the vfio_matrix_dev object in order to free its storage. The problem is, this object is not stored as drvdata with the device; since the kfree function will accept a NULL pointer, the memory for the vfio_matrix_dev object is never freed. Since the device being released is contained within the vfio_matrix_dev object, the container_of macro will be used to retrieve its pointer.

Metrics

EPSS Probability
0.16%

5.7th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 1fde573413b549d52183382e639c1d6ce88f5959, < 5195de1d5f66b276683240a896783f7f43c4f664; >= 1fde573413b549d52183382e639c1d6ce88f5959, < ee17dea3072dec0bc34399a32fa884e26342e4ea; >= 1fde573413b549d52183382e639c1d6ce88f5959, < aa2bff25e9bb10c935c7ffe3d5f5975bdccb1749; >= 1fde573413b549d52183382e639c1d6ce88f5959, < 6a40fda14b4be3e38f03cc42ffd4efbc64fb3e67; >= 1fde573413b549d52183382e639c1d6ce88f5959, < 7b6a02f5bf15931464c79dfd487c57f76aae3496; >= 1fde573413b549d52183382e639c1d6ce88f5959, < 8f8cf767589f2131ae5d40f3758429095c701c84
LinuxLinux4.20

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2023-53746?
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix memory leak in vfio_ap device driver The device release callback function invoked to release the matrix device uses the dev_get_drvdata(device *dev) function to retrieve the pointer to the vfio_matrix_dev object in order to free its storage. The problem is, this object is not stored as drvdata with the device; since the kfree function will accept a NULL pointer, the memory for the vfio_matrix_dev object is never freed. Since the device being released is contained within the vfio_matrix_dev object, the container_of macro will be used to retrieve its pointer.
How severe is CVE-2023-53746?
Severity scoring for CVE-2023-53746 is pending analysis. The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.
How do I fix CVE-2023-53746?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2023

View all 2023CVEs →

Are you affected by CVE-2023-53746?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST