CVE-2023-54058 (GCVE-0-2023-54058)
Vulnerability from cvelistv5
Published
2025-12-24 12:23
Modified
2025-12-24 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_ffa: Check if ffa_driver remove is present before executing
Currently ffa_drv->remove() is called unconditionally from
ffa_device_remove(). Since the driver registration doesn't check for it
and allows it to be registered without .remove callback, we need to check
for the presence of it before executing it from ffa_device_remove() to
above a NULL pointer dereference like the one below:
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
| Mem abort info:
| ESR = 0x0000000086000004
| EC = 0x21: IABT (current EL), IL = 32 bits
| SET = 0, FnV = 0
| EA = 0, S1PTW = 0
| FSC = 0x04: level 0 translation fault
| user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881cc8000
| [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
| Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP
| CPU: 3 PID: 130 Comm: rmmod Not tainted 6.3.0-rc7 #6
| Hardware name: FVP Base RevC (DT)
| pstate: 63402809 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=-c)
| pc : 0x0
| lr : ffa_device_remove+0x20/0x2c
| Call trace:
| 0x0
| device_release_driver_internal+0x16c/0x260
| driver_detach+0x90/0xd0
| bus_remove_driver+0xdc/0x11c
| driver_unregister+0x30/0x54
| ffa_driver_unregister+0x14/0x20
| cleanup_module+0x18/0xeec
| __arm64_sys_delete_module+0x234/0x378
| invoke_syscall+0x40/0x108
| el0_svc_common+0xb4/0xf0
| do_el0_svc+0x30/0xa4
| el0_svc+0x2c/0x7c
| el0t_64_sync_handler+0x84/0xf0
| el0t_64_sync+0x190/0x194
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_ffa/bus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6a26c62625c59b8dd7f52c518cb4f60a63470a0e",
"status": "affected",
"version": "244f5d597e1ea519c2085fbd9819458688775e42",
"versionType": "git"
},
{
"lessThan": "ad73dc7263ea90302d6c7eeb7e9f7cbcfa0b0617",
"status": "affected",
"version": "244f5d597e1ea519c2085fbd9819458688775e42",
"versionType": "git"
},
{
"lessThan": "48399c297c46b4c8e77ebcf071bb586a42d0ca4e",
"status": "affected",
"version": "244f5d597e1ea519c2085fbd9819458688775e42",
"versionType": "git"
},
{
"lessThan": "b71b55248a580e9c9befc4ae060539f1f8e477da",
"status": "affected",
"version": "244f5d597e1ea519c2085fbd9819458688775e42",
"versionType": "git"
},
{
"status": "affected",
"version": "06560ba731e2775441c6dc9f0bf39f9f3606fbb7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_ffa/bus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.31",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.31",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.5",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.14.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Check if ffa_driver remove is present before executing\n\nCurrently ffa_drv-\u003eremove() is called unconditionally from\nffa_device_remove(). Since the driver registration doesn\u0027t check for it\nand allows it to be registered without .remove callback, we need to check\nfor the presence of it before executing it from ffa_device_remove() to\nabove a NULL pointer dereference like the one below:\n\n | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n | Mem abort info:\n | ESR = 0x0000000086000004\n | EC = 0x21: IABT (current EL), IL = 32 bits\n | SET = 0, FnV = 0\n | EA = 0, S1PTW = 0\n | FSC = 0x04: level 0 translation fault\n | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881cc8000\n | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000\n | Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP\n | CPU: 3 PID: 130 Comm: rmmod Not tainted 6.3.0-rc7 #6\n | Hardware name: FVP Base RevC (DT)\n | pstate: 63402809 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=-c)\n | pc : 0x0\n | lr : ffa_device_remove+0x20/0x2c\n | Call trace:\n | 0x0\n | device_release_driver_internal+0x16c/0x260\n | driver_detach+0x90/0xd0\n | bus_remove_driver+0xdc/0x11c\n | driver_unregister+0x30/0x54\n | ffa_driver_unregister+0x14/0x20\n | cleanup_module+0x18/0xeec\n | __arm64_sys_delete_module+0x234/0x378\n | invoke_syscall+0x40/0x108\n | el0_svc_common+0xb4/0xf0\n | do_el0_svc+0x30/0xa4\n | el0_svc+0x2c/0x7c\n | el0t_64_sync_handler+0x84/0xf0\n | el0t_64_sync+0x190/0x194"
}
],
"providerMetadata": {
"dateUpdated": "2025-12-24T12:23:05.899Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6a26c62625c59b8dd7f52c518cb4f60a63470a0e"
},
{
"url": "https://git.kernel.org/stable/c/ad73dc7263ea90302d6c7eeb7e9f7cbcfa0b0617"
},
{
"url": "https://git.kernel.org/stable/c/48399c297c46b4c8e77ebcf071bb586a42d0ca4e"
},
{
"url": "https://git.kernel.org/stable/c/b71b55248a580e9c9befc4ae060539f1f8e477da"
}
],
"title": "firmware: arm_ffa: Check if ffa_driver remove is present before executing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-54058",
"datePublished": "2025-12-24T12:23:05.899Z",
"dateReserved": "2025-12-24T12:21:05.091Z",
"dateUpdated": "2025-12-24T12:23:05.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2023-54058\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T13:16:07.590\",\"lastModified\":\"2025-12-24T13:16:07.590\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware: arm_ffa: Check if ffa_driver remove is present before executing\\n\\nCurrently ffa_drv-\u003eremove() is called unconditionally from\\nffa_device_remove(). Since the driver registration doesn\u0027t check for it\\nand allows it to be registered without .remove callback, we need to check\\nfor the presence of it before executing it from ffa_device_remove() to\\nabove a NULL pointer dereference like the one below:\\n\\n | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\\n | Mem abort info:\\n | ESR = 0x0000000086000004\\n | EC = 0x21: IABT (current EL), IL = 32 bits\\n | SET = 0, FnV = 0\\n | EA = 0, S1PTW = 0\\n | FSC = 0x04: level 0 translation fault\\n | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881cc8000\\n | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000\\n | Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP\\n | CPU: 3 PID: 130 Comm: rmmod Not tainted 6.3.0-rc7 #6\\n | Hardware name: FVP Base RevC (DT)\\n | pstate: 63402809 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=-c)\\n | pc : 0x0\\n | lr : ffa_device_remove+0x20/0x2c\\n | Call trace:\\n | 0x0\\n | device_release_driver_internal+0x16c/0x260\\n | driver_detach+0x90/0xd0\\n | bus_remove_driver+0xdc/0x11c\\n | driver_unregister+0x30/0x54\\n | ffa_driver_unregister+0x14/0x20\\n | cleanup_module+0x18/0xeec\\n | __arm64_sys_delete_module+0x234/0x378\\n | invoke_syscall+0x40/0x108\\n | el0_svc_common+0xb4/0xf0\\n | do_el0_svc+0x30/0xa4\\n | el0_svc+0x2c/0x7c\\n | el0t_64_sync_handler+0x84/0xf0\\n | el0t_64_sync+0x190/0x194\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/48399c297c46b4c8e77ebcf071bb586a42d0ca4e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6a26c62625c59b8dd7f52c518cb4f60a63470a0e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ad73dc7263ea90302d6c7eeb7e9f7cbcfa0b0617\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b71b55248a580e9c9befc4ae060539f1f8e477da\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…