NetSight
IP …
high7.8

CVE-2023-52457

In the Linux kernel, the following vulnerability has been resolved: serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed Retur…

Impact

In the Linux kernel, the following vulnerability has been resolved: serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed Returning an error code from .remove() makes the driver core emit the little helpful error message: remove callback returned a non-zero value. This will be ignored. and then remove the device anyhow. So all resources that were not freed are leaked in this case. Skipping serial8250_unregister_port() has the potential to keep enough of the UART around to trigger a use-after-free. So replace the error return (and with it the little helpful error message) by a more useful error message and continue to cleanup.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 5.4.225 before 5.4.268
from 5.10.156 before 5.10.209
from 5.15.80 before 5.15.148
from 6.0.10 before 6.1.75
from 6.2 before 6.6.14
from 6.7 before 6.7.2

Weakness classification

CWE-416

References