CVE-2023-53515

In the Linux kernel, the following vulnerability has been resolved:

virtio-mmio: don't break lifecycle of vm_dev

vm_dev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is correct.

Allocating the vm_dev struct with devres totally breaks this protection, though. Instead of waiting for the vm_dev release callback, the memory is freed when the platform_device is removed. Resulting in a use-after-free when finally the callback is to be called.

To easily see the problem, compile the kernel with CONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs.

The fix is easy, don't use devres in this case.

Found during my research about object lifetime problems.

The patch fixes a Use-After-Free in the virtio_mmio driver caused by using devres (devm_kzalloc) for a structure (vm_dev) with a separate lifetime controlled by its release callback. When the parent platform device was removed, devres prematurely freed vm_dev, and a later release triggered a UAF. The issue can lead to a kernel crash when unbinding the device (e.g. via sysfs), and is limited to privileged contexts managing platform devices.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.