github - ghsa-pjxh-qq38-qww3

ghsa-pjxh-qq38-qww3

Vulnerability from github

Published

2025-09-15 15:31

Modified

2025-09-15 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

dma-buf/dma-resv: Stop leaking on krealloc() failure

Currently dma_resv_get_fences() will leak the previously allocated array if the fence iteration got restarted and the krealloc_array() fails.

Free the old array by hand, and make sure we still clear the returned fences so the caller won't end up accessing freed memory. Some (but not all) of the callers of dma_resv_get_fences() seem to still trawl through the array even when dma_resv_get_fences() failed. And let's zero out num_fences as well for good measure.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-53181"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-15T14:15:40Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf/dma-resv: Stop leaking on krealloc() failure\n\nCurrently dma_resv_get_fences() will leak the previously\nallocated array if the fence iteration got restarted and\nthe krealloc_array() fails.\n\nFree the old array by hand, and make sure we still clear\nthe returned *fences so the caller won\u0027t end up accessing\nfreed memory. Some (but not all) of the callers of\ndma_resv_get_fences() seem to still trawl through the\narray even when dma_resv_get_fences() failed. And let\u0027s\nzero out *num_fences as well for good measure.",
  "id": "GHSA-pjxh-qq38-qww3",
  "modified": "2025-09-15T15:31:24Z",
  "published": "2025-09-15T15:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53181"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/05abb3be91d8788328231ee02973ab3d47f5e3d2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/19e7b9f1f7e1cb92a4cc53b4c064f7fb4b1f1983"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/819656cc03dec7f7f7800274dfbc8eb49f888e9f"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2023-53181 (GCVE-0-2023-53181)

Vulnerability from cvelistv5

Published

2025-09-15 14:04

Modified

2025-09-15 14:04

Severity ?

Summary

In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-resv: Stop leaking on krealloc() failure Currently dma_resv_get_fences() will leak the previously allocated array if the fence iteration got restarted and the krealloc_array() fails. Free the old array by hand, and make sure we still clear the returned *fences so the caller won't end up accessing freed memory. Some (but not all) of the callers of dma_resv_get_fences() seem to still trawl through the array even when dma_resv_get_fences() failed. And let's zero out *num_fences as well for good measure.

References

▼	URL	Tags
	https://git.kernel.org/stable/c/19e7b9f1f7e1cb92a4cc53b4c064f7fb4b1f1983
	https://git.kernel.org/stable/c/819656cc03dec7f7f7800274dfbc8eb49f888e9f
	https://git.kernel.org/stable/c/05abb3be91d8788328231ee02973ab3d47f5e3d2

Impacted products

Vendor

Product

Version

▼

Linux

Version: d3c80698c9f58a0683badf78793eebaa0c71afbd
Version: d3c80698c9f58a0683badf78793eebaa0c71afbd
Version: d3c80698c9f58a0683badf78793eebaa0c71afbd

Linux

Version: 5.16

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma-buf/dma-resv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "19e7b9f1f7e1cb92a4cc53b4c064f7fb4b1f1983",
              "status": "affected",
              "version": "d3c80698c9f58a0683badf78793eebaa0c71afbd",
              "versionType": "git"
            },
            {
              "lessThan": "819656cc03dec7f7f7800274dfbc8eb49f888e9f",
              "status": "affected",
              "version": "d3c80698c9f58a0683badf78793eebaa0c71afbd",
              "versionType": "git"
            },
            {
              "lessThan": "05abb3be91d8788328231ee02973ab3d47f5e3d2",
              "status": "affected",
              "version": "d3c80698c9f58a0683badf78793eebaa0c71afbd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma-buf/dma-resv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.42",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.7",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf/dma-resv: Stop leaking on krealloc() failure\n\nCurrently dma_resv_get_fences() will leak the previously\nallocated array if the fence iteration got restarted and\nthe krealloc_array() fails.\n\nFree the old array by hand, and make sure we still clear\nthe returned *fences so the caller won\u0027t end up accessing\nfreed memory. Some (but not all) of the callers of\ndma_resv_get_fences() seem to still trawl through the\narray even when dma_resv_get_fences() failed. And let\u0027s\nzero out *num_fences as well for good measure."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T14:04:32.098Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/19e7b9f1f7e1cb92a4cc53b4c064f7fb4b1f1983"
        },
        {
          "url": "https://git.kernel.org/stable/c/819656cc03dec7f7f7800274dfbc8eb49f888e9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/05abb3be91d8788328231ee02973ab3d47f5e3d2"
        }
      ],
      "title": "dma-buf/dma-resv: Stop leaking on krealloc() failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53181",
    "datePublished": "2025-09-15T14:04:32.098Z",
    "dateReserved": "2025-09-15T13:59:19.065Z",
    "dateUpdated": "2025-09-15T14:04:32.098Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted