CVE-2023-52503 (GCVE-0-2023-52503)

Vulnerability from cvelistv5 – Published: 2024-03-02 21:52 – Updated: 2026-08-05 09:10
VLAI
Title
tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
Summary
In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix use-after-free vulnerability in amdtee_close_session There is a potential race condition in amdtee_close_session that may cause use-after-free in amdtee_open_session. For instance, if a session has refcount == 1, and one thread tries to free this session via: kref_put(&sess->refcount, destroy_session); the reference count will get decremented, and the next step would be to call destroy_session(). However, if in another thread, amdtee_open_session() is called before destroy_session() has completed execution, alloc_session() may return 'sess' that will be freed up later in destroy_session() leading to use-after-free in amdtee_open_session. To fix this issue, treat decrement of sess->refcount and removal of 'sess' from session list in destroy_session() as a critical section, so that it is executed atomically.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-08 18:34 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 757cc3e9ff1d72d014096399d6e2bf03974d9da1 , < da7ce52a2f6c468946195b116615297d3d113a27 (git)
Affected: 757cc3e9ff1d72d014096399d6e2bf03974d9da1 , < 1680c82929bc14d706065f123dab77f2f1293116 (git)
Affected: 757cc3e9ff1d72d014096399d6e2bf03974d9da1 , < 60c3e7a00db954947c265b55099c21b216f2a05c (git)
Affected: 757cc3e9ff1d72d014096399d6e2bf03974d9da1 , < 1c95574350cd63bc3c5c2fa06658010768f2a0ce (git)
Affected: 757cc3e9ff1d72d014096399d6e2bf03974d9da1 , < f4384b3e54ea813868bb81a861bf5b2406e15d8f (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.6
Unaffected: 0 , < 5.6 (semver)
Unaffected: 5.10.199 , ≤ 5.10.* (semver)
Unaffected: 5.15.136 , ≤ 5.15.* (semver)
Unaffected: 6.1.59 , ≤ 6.1.* (semver)
Unaffected: 6.5.8 , ≤ 6.5.* (semver)
Unaffected: 6.6 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:20.580Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/da7ce52a2f6c468946195b116615297d3d113a27"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1680c82929bc14d706065f123dab77f2f1293116"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/60c3e7a00db954947c265b55099c21b216f2a05c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1c95574350cd63bc3c5c2fa06658010768f2a0ce"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f4384b3e54ea813868bb81a861bf5b2406e15d8f"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52503",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-08T18:34:27.896164Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-08T18:34:37.754Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tee/amdtee/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "da7ce52a2f6c468946195b116615297d3d113a27",
              "status": "affected",
              "version": "757cc3e9ff1d72d014096399d6e2bf03974d9da1",
              "versionType": "git"
            },
            {
              "lessThan": "1680c82929bc14d706065f123dab77f2f1293116",
              "status": "affected",
              "version": "757cc3e9ff1d72d014096399d6e2bf03974d9da1",
              "versionType": "git"
            },
            {
              "lessThan": "60c3e7a00db954947c265b55099c21b216f2a05c",
              "status": "affected",
              "version": "757cc3e9ff1d72d014096399d6e2bf03974d9da1",
              "versionType": "git"
            },
            {
              "lessThan": "1c95574350cd63bc3c5c2fa06658010768f2a0ce",
              "status": "affected",
              "version": "757cc3e9ff1d72d014096399d6e2bf03974d9da1",
              "versionType": "git"
            },
            {
              "lessThan": "f4384b3e54ea813868bb81a861bf5b2406e15d8f",
              "status": "affected",
              "version": "757cc3e9ff1d72d014096399d6e2bf03974d9da1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tee/amdtee/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.199",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.136",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.59",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.8",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntee: amdtee: fix use-after-free vulnerability in amdtee_close_session\n\nThere is a potential race condition in amdtee_close_session that may\ncause use-after-free in amdtee_open_session. For instance, if a session\nhas refcount == 1, and one thread tries to free this session via:\n\n    kref_put(\u0026sess-\u003erefcount, destroy_session);\n\nthe reference count will get decremented, and the next step would be to\ncall destroy_session(). However, if in another thread,\namdtee_open_session() is called before destroy_session() has completed\nexecution, alloc_session() may return \u0027sess\u0027 that will be freed up\nlater in destroy_session() leading to use-after-free in\namdtee_open_session.\n\nTo fix this issue, treat decrement of sess-\u003erefcount and removal of\n\u0027sess\u0027 from session list in destroy_session() as a critical section, so\nthat it is executed atomically."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through TEE_IOC_OPEN_SESSION and TEE_IOC_CLOSE_SESSION ioctls on the amdtee client device (/dev/tee*), requiring local process access to the character device rather than network or adjacent packet delivery.\nAC:L - The attacker fully controls both sides of the race by sharing one tee_context fd across threads and concurrently issuing open_session and close_session for the same TA; per guidance, attacker-driven races are AC:L.\nPR:L - amdtee registers an unprivileged client tee device with no capability checks in tee_open or the ioctl path; access is only via device-node permissions, and normal TEE clients on AMD TEE deployments (e.g. Chromebooks) are unprivileged local users.\nUI:N - Exploitation requires only the attacker\u0027s own open/close session ioctls; no victim action such as mounting a filesystem or opening a malicious file is needed.\nS:U - The use-after-free is in the Linux kernel amdtee driver and impacts the host kernel\u0027s authority; this is standard local privilege escalation, not a VM/IOMMU/sandbox boundary crossing.\nC:H - Use-after-free of struct amdtee_session lets the attacker reclaim and control the freed object contents, enabling arbitrary kernel memory disclosure primitives.\nI:H - After the free, amdtee_open_session continues to write session_info and sess_mask under sess-\u003elock on the dangling pointer, yielding a heap UAF write usable for control-flow hijacking or arbitrary kernel writes.\nA:H - Any use-after-free of a kernel session object can oops or panic the kernel when the dangling pointer is locked or dereferenced, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:10:17.128Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/da7ce52a2f6c468946195b116615297d3d113a27"
        },
        {
          "url": "https://git.kernel.org/stable/c/1680c82929bc14d706065f123dab77f2f1293116"
        },
        {
          "url": "https://git.kernel.org/stable/c/60c3e7a00db954947c265b55099c21b216f2a05c"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c95574350cd63bc3c5c2fa06658010768f2a0ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4384b3e54ea813868bb81a861bf5b2406e15d8f"
        }
      ],
      "title": "tee: amdtee: fix use-after-free vulnerability in amdtee_close_session",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52503",
    "datePublished": "2024-03-02T21:52:17.854Z",
    "dateReserved": "2024-02-20T12:30:33.313Z",
    "dateUpdated": "2026-08-05T09:10:17.128Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52503",
      "date": "2026-10-01",
      "epss": "0.0026",
      "percentile": "0.16072"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "7BEA3A23-5DDA-4C82-91AB-12FA1B3FD828",
                  "versionEndExcluding": "5.10.199",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B1FA5161-3AC0-44DF-B1F7-93A070F2B1E7",
                  "versionEndExcluding": "5.15.136",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "96EA633C-1F3E-41C5-A13A-155C55A1F273",
                  "versionEndExcluding": "6.1.59",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "AD4E15B4-2591-4A3A-B2A2-7FEAECD5027D",
                  "versionEndExcluding": "6.5.8",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "84267A4F-DBC2-444F-B41D-69E15E1BEC97",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc2:*:*:*:*:*:*",
                  "matchCriteriaId": "FB440208-241C-4246-9A83-C1715C0DAA6C",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc3:*:*:*:*:*:*",
                  "matchCriteriaId": "0DC421F1-3D5A-4BEF-BF76-4E468985D20B",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc4:*:*:*:*:*:*",
                  "matchCriteriaId": "00AB783B-BE05-40E8-9A55-6AA457D95031",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc5:*:*:*:*:*:*",
                  "matchCriteriaId": "E7C78D0A-C4A2-4D41-B726-8979E33AD0F9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntee: amdtee: fix use-after-free vulnerability in amdtee_close_session\n\nThere is a potential race condition in amdtee_close_session that may\ncause use-after-free in amdtee_open_session. For instance, if a session\nhas refcount == 1, and one thread tries to free this session via:\n\n    kref_put(\u0026sess-\u003erefcount, destroy_session);\n\nthe reference count will get decremented, and the next step would be to\ncall destroy_session(). However, if in another thread,\namdtee_open_session() is called before destroy_session() has completed\nexecution, alloc_session() may return \u0027sess\u0027 that will be freed up\nlater in destroy_session() leading to use-after-free in\namdtee_open_session.\n\nTo fix this issue, treat decrement of sess-\u003erefcount and removal of\n\u0027sess\u0027 from session list in destroy_session() as a critical section, so\nthat it is executed atomically."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: tee: amdtee: corrige la vulnerabilidad de Use After Free en amdtee_close_session Existe una posible condici\u00f3n de ejecuci\u00f3n en amdtee_close_session que puede causar el Use After Free en amdtee_open_session. Por ejemplo, si una sesi\u00f3n tiene refcount == 1 y un hilo intenta liberar esta sesi\u00f3n mediante: kref_put(\u0026amp;sess-\u0026gt;refcount, destroy_session); el recuento de referencias disminuir\u00e1 y el siguiente paso ser\u00eda llamar a destroy_session(). Sin embargo, si en otro hilo, se llama a amdtee_open_session() antes de que destroy_session() haya completado la ejecuci\u00f3n, alloc_session() puede devolver \u0027sess\u0027 que se liberar\u00e1 m\u00e1s tarde en destroy_session(), lo que conducir\u00e1 a Use After Free en amdtee_open_session. Para solucionar este problema, trate la disminuci\u00f3n de sess-\u0026gt;refcount y la eliminaci\u00f3n de \u0027sess\u0027 de la lista de sesiones en destroy_session() como una secci\u00f3n cr\u00edtica, para que se ejecute de forma at\u00f3mica."
        }
      ],
      "id": "CVE-2023-52503",
      "lastModified": "2024-12-10T21:26:43.377",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.0,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.0,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-03-02T22:15:47.250",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/1680c82929bc14d706065f123dab77f2f1293116"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/1c95574350cd63bc3c5c2fa06658010768f2a0ce"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/60c3e7a00db954947c265b55099c21b216f2a05c"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/da7ce52a2f6c468946195b116615297d3d113a27"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/f4384b3e54ea813868bb81a861bf5b2406e15d8f"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/1680c82929bc14d706065f123dab77f2f1293116"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/1c95574350cd63bc3c5c2fa06658010768f2a0ce"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/60c3e7a00db954947c265b55099c21b216f2a05c"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/da7ce52a2f6c468946195b116615297d3d113a27"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/f4384b3e54ea813868bb81a861bf5b2406e15d8f"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-416"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/tee/amdtee/core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "da7ce52a2f6c468946195b116615297d3d113a27",
                    "status": "affected",
                    "version": "757cc3e9ff1d72d014096399d6e2bf03974d9da1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1680c82929bc14d706065f123dab77f2f1293116",
                    "status": "affected",
                    "version": "757cc3e9ff1d72d014096399d6e2bf03974d9da1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "60c3e7a00db954947c265b55099c21b216f2a05c",
                    "status": "affected",
                    "version": "757cc3e9ff1d72d014096399d6e2bf03974d9da1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1c95574350cd63bc3c5c2fa06658010768f2a0ce",
                    "status": "affected",
                    "version": "757cc3e9ff1d72d014096399d6e2bf03974d9da1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f4384b3e54ea813868bb81a861bf5b2406e15d8f",
                    "status": "affected",
                    "version": "757cc3e9ff1d72d014096399d6e2bf03974d9da1",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/tee/amdtee/core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.6"
                  },
                  {
                    "lessThan": "5.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.199",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.136",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.59",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.5.*",
                    "status": "unaffected",
                    "version": "6.5.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.6",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7BEA3A23-5DDA-4C82-91AB-12FA1B3FD828",
                    "versionEndExcluding": "5.10.199",
                    "versionStartIncluding": "5.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B1FA5161-3AC0-44DF-B1F7-93A070F2B1E7",
                    "versionEndExcluding": "5.15.136",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "96EA633C-1F3E-41C5-A13A-155C55A1F273",
                    "versionEndExcluding": "6.1.59",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AD4E15B4-2591-4A3A-B2A2-7FEAECD5027D",
                    "versionEndExcluding": "6.5.8",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "84267A4F-DBC2-444F-B41D-69E15E1BEC97",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "FB440208-241C-4246-9A83-C1715C0DAA6C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "0DC421F1-3D5A-4BEF-BF76-4E468985D20B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "00AB783B-BE05-40E8-9A55-6AA457D95031",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "E7C78D0A-C4A2-4D41-B726-8979E33AD0F9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntee: amdtee: fix use-after-free vulnerability in amdtee_close_session\n\nThere is a potential race condition in amdtee_close_session that may\ncause use-after-free in amdtee_open_session. For instance, if a session\nhas refcount == 1, and one thread tries to free this session via:\n\n    kref_put(\u0026sess-\u003erefcount, destroy_session);\n\nthe reference count will get decremented, and the next step would be to\ncall destroy_session(). However, if in another thread,\namdtee_open_session() is called before destroy_session() has completed\nexecution, alloc_session() may return \u0027sess\u0027 that will be freed up\nlater in destroy_session() leading to use-after-free in\namdtee_open_session.\n\nTo fix this issue, treat decrement of sess-\u003erefcount and removal of\n\u0027sess\u0027 from session list in destroy_session() as a critical section, so\nthat it is executed atomically."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: tee: amdtee: corrige la vulnerabilidad de Use After Free en amdtee_close_session Existe una posible condici\u00f3n de ejecuci\u00f3n en amdtee_close_session que puede causar el Use After Free en amdtee_open_session. Por ejemplo, si una sesi\u00f3n tiene refcount == 1 y un hilo intenta liberar esta sesi\u00f3n mediante: kref_put(\u0026amp;sess-\u0026gt;refcount, destroy_session); el recuento de referencias disminuir\u00e1 y el siguiente paso ser\u00eda llamar a destroy_session(). Sin embargo, si en otro hilo, se llama a amdtee_open_session() antes de que destroy_session() haya completado la ejecuci\u00f3n, alloc_session() puede devolver \u0027sess\u0027 que se liberar\u00e1 m\u00e1s tarde en destroy_session(), lo que conducir\u00e1 a Use After Free en amdtee_open_session. Para solucionar este problema, trate la disminuci\u00f3n de sess-\u0026gt;refcount y la eliminaci\u00f3n de \u0027sess\u0027 de la lista de sesiones en destroy_session() como una secci\u00f3n cr\u00edtica, para que se ejecute de forma at\u00f3mica."
          }
        ],
        "id": "CVE-2023-52503",
        "lastModified": "2026-08-04T10:18:30.827",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-52503",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-08T18:34:27.896164Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-03-02T22:15:47.250",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1680c82929bc14d706065f123dab77f2f1293116"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1c95574350cd63bc3c5c2fa06658010768f2a0ce"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/60c3e7a00db954947c265b55099c21b216f2a05c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/da7ce52a2f6c468946195b116615297d3d113a27"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f4384b3e54ea813868bb81a861bf5b2406e15d8f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1680c82929bc14d706065f123dab77f2f1293116"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1c95574350cd63bc3c5c2fa06658010768f2a0ce"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/60c3e7a00db954947c265b55099c21b216f2a05c"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/da7ce52a2f6c468946195b116615297d3d113a27"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f4384b3e54ea813868bb81a861bf5b2406e15d8f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:58:08+00:00",
      "cve": "CVE-2023-52503",
      "id": "CVE-2023-52503",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tee: amdtee: fix use-after-free vulnerability in amdtee_close_session",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52503.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:18:20Z",
      "cve": "CVE-2023-52503",
      "id": "CVE-2023-52503",
      "initial_release_date": "2024-03-06T04:34:34Z",
      "product_status:known_affected": "457",
      "product_status:known_not_affected": "287",
      "product_status:recommended": "585",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-52503",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-52503.json",
      "version": "89"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T23:03:20.580Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/da7ce52a2f6c468946195b116615297d3d113a27"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/1680c82929bc14d706065f123dab77f2f1293116"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/60c3e7a00db954947c265b55099c21b216f2a05c"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/1c95574350cd63bc3c5c2fa06658010768f2a0ce"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/f4384b3e54ea813868bb81a861bf5b2406e15d8f"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-52503",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-08-08T18:34:27.896164Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-08-08T18:34:33.506Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/tee/amdtee/core.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "da7ce52a2f6c468946195b116615297d3d113a27",
                  "status": "affected",
                  "version": "757cc3e9ff1d72d014096399d6e2bf03974d9da1",
                  "versionType": "git"
                },
                {
                  "lessThan": "1680c82929bc14d706065f123dab77f2f1293116",
                  "status": "affected",
                  "version": "757cc3e9ff1d72d014096399d6e2bf03974d9da1",
                  "versionType": "git"
                },
                {
                  "lessThan": "60c3e7a00db954947c265b55099c21b216f2a05c",
                  "status": "affected",
                  "version": "757cc3e9ff1d72d014096399d6e2bf03974d9da1",
                  "versionType": "git"
                },
                {
                  "lessThan": "1c95574350cd63bc3c5c2fa06658010768f2a0ce",
                  "status": "affected",
                  "version": "757cc3e9ff1d72d014096399d6e2bf03974d9da1",
                  "versionType": "git"
                },
                {
                  "lessThan": "f4384b3e54ea813868bb81a861bf5b2406e15d8f",
                  "status": "affected",
                  "version": "757cc3e9ff1d72d014096399d6e2bf03974d9da1",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/tee/amdtee/core.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.6"
                },
                {
                  "lessThan": "5.6",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.199",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.136",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.59",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.5.*",
                  "status": "unaffected",
                  "version": "6.5.8",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.6",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.199",
                      "versionStartIncluding": "5.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.136",
                      "versionStartIncluding": "5.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.59",
                      "versionStartIncluding": "5.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.5.8",
                      "versionStartIncluding": "5.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6",
                      "versionStartIncluding": "5.6",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntee: amdtee: fix use-after-free vulnerability in amdtee_close_session\n\nThere is a potential race condition in amdtee_close_session that may\ncause use-after-free in amdtee_open_session. For instance, if a session\nhas refcount == 1, and one thread tries to free this session via:\n\n    kref_put(\u0026sess-\u003erefcount, destroy_session);\n\nthe reference count will get decremented, and the next step would be to\ncall destroy_session(). However, if in another thread,\namdtee_open_session() is called before destroy_session() has completed\nexecution, alloc_session() may return \u0027sess\u0027 that will be freed up\nlater in destroy_session() leading to use-after-free in\namdtee_open_session.\n\nTo fix this issue, treat decrement of sess-\u003erefcount and removal of\n\u0027sess\u0027 from session list in destroy_session() as a critical section, so\nthat it is executed atomically."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerability is reached through TEE_IOC_OPEN_SESSION and TEE_IOC_CLOSE_SESSION ioctls on the amdtee client device (/dev/tee*), requiring local process access to the character device rather than network or adjacent packet delivery.\nAC:L - The attacker fully controls both sides of the race by sharing one tee_context fd across threads and concurrently issuing open_session and close_session for the same TA; per guidance, attacker-driven races are AC:L.\nPR:L - amdtee registers an unprivileged client tee device with no capability checks in tee_open or the ioctl path; access is only via device-node permissions, and normal TEE clients on AMD TEE deployments (e.g. Chromebooks) are unprivileged local users.\nUI:N - Exploitation requires only the attacker\u0027s own open/close session ioctls; no victim action such as mounting a filesystem or opening a malicious file is needed.\nS:U - The use-after-free is in the Linux kernel amdtee driver and impacts the host kernel\u0027s authority; this is standard local privilege escalation, not a VM/IOMMU/sandbox boundary crossing.\nC:H - Use-after-free of struct amdtee_session lets the attacker reclaim and control the freed object contents, enabling arbitrary kernel memory disclosure primitives.\nI:H - After the free, amdtee_open_session continues to write session_info and sess_mask under sess-\u003elock on the dangling pointer, yielding a heap UAF write usable for control-flow hijacking or arbitrary kernel writes.\nA:H - Any use-after-free of a kernel session object can oops or panic the kernel when the dangling pointer is locked or dereferenced, so availability impact is High."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T09:10:17.128Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/da7ce52a2f6c468946195b116615297d3d113a27"
            },
            {
              "url": "https://git.kernel.org/stable/c/1680c82929bc14d706065f123dab77f2f1293116"
            },
            {
              "url": "https://git.kernel.org/stable/c/60c3e7a00db954947c265b55099c21b216f2a05c"
            },
            {
              "url": "https://git.kernel.org/stable/c/1c95574350cd63bc3c5c2fa06658010768f2a0ce"
            },
            {
              "url": "https://git.kernel.org/stable/c/f4384b3e54ea813868bb81a861bf5b2406e15d8f"
            }
          ],
          "title": "tee: amdtee: fix use-after-free vulnerability in amdtee_close_session",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2023-52503",
        "datePublished": "2024-03-02T21:52:17.854Z",
        "dateReserved": "2024-02-20T12:30:33.313Z",
        "dateUpdated": "2026-08-05T09:10:17.128Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.