{
  "cveId": "CVE-2023-52564",
  "url": "https://patchblox.com/security/cve/CVE-2023-52564",
  "summary": "CVE-2023-52564 is fixed in linux on 1 platform, first by DEBIAN-CVE-2023-52564, released March 2, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  Revert \u0022tty: n_gsm: fix UAF in gsm_cleanup_mux\u0022...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  Revert \u0022tty: n_gsm: fix UAF in gsm_cleanup_mux\u0022  This reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239.  The commit above is reverted as it did not solve the original issue.  gsm_cleanup_mux() tries to free up the virtual ttys by calling gsm_dlci_release() for each available DLCI. There, dlci_put() is called to decrease the reference counter for the DLCI via tty_port_put() which finally calls gsm_dlci_free(). This already clears the pointer which is being checked in gsm_cleanup_mux() before calling gsm_dlci_release(). Therefore, it is not necessary to clear this pointer in gsm_cleanup_mux() as done in the reverted commit. The commit introduces a null pointer dereference:  \u003CTASK\u003E  ? __die\u002B0x1f/0x70  ? page_fault_oops\u002B0x156/0x420  ? search_exception_tables\u002B0x37/0x50  ? fixup_exception\u002B0x21/0x310  ? exc_page_fault\u002B0x69/0x150  ? asm_exc_page_fault\u002B0x26/0x30  ? tty_port_put\u002B0x19/0xa0  gsmtty_cleanup\u002B0x29/0x80 [n_gsm]  release_one_tty\u002B0x37/0xe0  process_one_work\u002B0x1e6/0x3e0  worker_thread\u002B0x4c/0x3d0  ? __pfx_worker_thread\u002B0x10/0x10  kthread\u002B0xe1/0x110  ? __pfx_kthread\u002B0x10/0x10  ret_from_fork\u002B0x2f/0x50  ? __pfx_kthread\u002B0x10/0x10  ret_from_fork_asm\u002B0x1b/0x30  \u003C/TASK\u003E  The actual issue is that nothing guards dlci_put() from being called multiple times while the tty driver was triggered but did not yet finished calling gsm_dlci_free().",
  "published": "2024-03-02T22:15:48Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.0025,
  "epssPercentile": 0.16491,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.64-1",
      "fix": "DEBIAN-CVE-2023-52564",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52564",
      "released": "2024-03-02T22:15:48Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.5.6-1",
      "fix": "DEBIAN-CVE-2023-52564",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52564",
      "released": "2024-03-02T22:15:48Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.5.6-1",
      "fix": "DEBIAN-CVE-2023-52564",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52564",
      "released": "2024-03-02T22:15:48Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}