Bug 1212536 (CVE-2023-3312) - VUL-0: CVE-2023-3312: kernel-source,kernel-source-azure,kernel-source-rt: double free in IO unmap and resource release on exit in drivers/cpufreq/qcom-cpufreq-hw.c
Summary: VUL-0: CVE-2023-3312: kernel-source,kernel-source-azure,kernel-source-rt: dou...
Status: RESOLVED FIXED
Alias: CVE-2023-3312
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: aarch64 Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Giovanni Gherdovich
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/369860/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-3312:4.4:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-06-20 09:54 UTC by Cathy Hu
Modified: 2023-08-15 12:35 UTC (History)
10 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Cathy Hu 2023-06-20 09:54:38 UTC 
CVE-2023-3312

A vulnerability was found in drivers/cpufreq/qcom-cpufreq-hw.c in cpufreq subsystem in the Linux Kernel. This flaw, during device unbind this will lead to doule release of resource problem.

Refer:
https://patchwork.kernel.org/project/linux-pm/patch/20230323174026.950622-1-krzysztof.kozlowski@linaro.org/

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3312
https://bugzilla.redhat.com/show_bug.cgi?id=2215847
https://www.cve.org/CVERecord?id=CVE-2023-3312
https://patchwork.kernel.org/project/linux-pm/patch/20230323174026.950622-1-krzysztof.kozlowski@linaro.org/
Comment 1 Cathy Hu 2023-06-20 09:56:37 UTC 
Commit introducing the issue: https://github.com/torvalds/linux/commit/054a3ef683a1

Fixing commit: Not upstream yet as far as i can see
https://patchwork.kernel.org/project/linux-pm/patch/20230323174026.950622-1-krzysztof.kozlowski@linaro.org/

Affected:
- stable
- ALP-current

Not Affected:
- SLE12-SP5
- SLE15-SP4-AZURE
- SLE15-SP4-RT
- SLE15-SP4
- SLE15-SP5
- SLE15-SP5-AZURE
- SLE15-SP5-RT
- cve/linux-3.0
- cve/linux-4.12
- cve/linux-4.4
- cve/linux-5.3
Comment 2 Joey Lee 2023-06-21 04:42:10 UTC 
(In reply to Hu from comment #1)
> Commit introducing the issue:
> https://github.com/torvalds/linux/commit/054a3ef683a1
> 
> Fixing commit: Not upstream yet as far as i can see
> https://patchwork.kernel.org/project/linux-pm/patch/20230323174026.950622-1-
> krzysztof.kozlowski@linaro.org/
> 
> Affected:
> - stable
> - ALP-current
> 

In supported.conf of ALP-current, qcom-cpufreq-hw is a unsupported module. Do we really need to patch it?

kernel-source> cat supported.conf  | grep qcom-cpufreq-hw
...
# Use "-" for unsupported modules, "+base" for modules for
...
-               drivers/cpufreq/qcom-cpufreq-hw

> Not Affected:
> - SLE12-SP5
> - SLE15-SP4-AZURE
> - SLE15-SP4-RT
> - SLE15-SP4
> - SLE15-SP5
> - SLE15-SP5-AZURE
> - SLE15-SP5-RT
> - cve/linux-3.0
> - cve/linux-4.12
> - cve/linux-4.4
> - cve/linux-5.3
Comment 3 Takashi Iwai 2023-06-21 05:49:25 UTC 
As of now, the support status on ALP-current branch isn't solid at all, so please don't trust it.  And, even an unsupported module may be shipped with SLE-Desktop or Leap, so it should be fixed if possible.
Comment 4 Cathy Hu 2023-06-21 07:42:51 UTC 
yep, we need to fix it currently as Takashi said. thanks a lot :)
Comment 5 Joey Lee 2023-06-23 00:42:03 UTC 
OK, let's waiting the patch be merged on mainline.
Comment 11 Giovanni Gherdovich 2023-08-14 22:47:47 UTC 
Hello, this commit is already included in the ALP-current kernel branch, so there is nothing to backport and I'm closing the bug.

The commit in question is ba5e770c9698 ("cpufreq: qcom-cpufreq-hw: fix double IO unmap and resource release on exit") is released in Linux v6.4.
The ALP kernel is based on v6.4. It's already in.

This command from the upstream Linux repo shows ba5e770c9698 is from v6.4:

    $ git tag --contains ba5e770c9698 --sort version:refname
    v6.4
    v6.4-rc1
    v6.4-rc2
    v6.4-rc3
    v6.4-rc4
    v6.4-rc5
    v6.4-rc6
    v6.4-rc7
    v6.5-rc1
    v6.5-rc2
    v6.5-rc3
    v6.5-rc4
    v6.5-rc5
    v6.5-rc6

This command from the SLES expanded kernel repo shows ba5e770c9698 is included in ALP-current:

    $ git merge-base --is-ancestor ba5e770c9698 ALP-current
    $ echo $?
    0

I believe the confusion originated as initially it was thought that ALP would be based on 6.3, but it was then decided to use 6.4 as base, see https://confluence.suse.com/display/LEONG/Kernel+version

Closing as resolved.
Comment 12 Cathy Hu 2023-08-15 12:35:08 UTC 
Hi Giovanni,

please dont close this bug when you are done, just reassign it back to security-team@suse.de

We will close this once the update is released.

Thank you!