The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
CVE-2023-53123: In the Linux kernel, the following vulnerability has been resolved: PCI: s390: Fix use-after-free of PCI resources with…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2023-53123
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
A flaw in the Linux kernel's s390 PCI code allows a use-after-free of PCI resources when individual PCI functions are hot-unplugged and re-added, which is common with SR-IOV virtual functions. The struct pci_bus and struct zpci_bus resource lists kept references to MMIO resources that were freed on hot-unplug, and these stale resources could be claimed when the function reappeared. The fix removes the resources of an individually unplugged function from the bus resource list through a new pci_bus_remove_resource() helper.
Mitigation
The fix introduces pci_bus_remove_resource() to remove the resources of an individually hot-unplugged PCI function from the PCI bus's resource list, and the MMIO resources are no longer added to struct zpci_bus's resource list, with zpci_bar_struct's resource pointer used directly.