CVE-2023-53515

In the Linux kernel, the following vulnerability has been resolved: virtio-mmio: don't break lifecycle of vm_dev vm_dev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is correct. Allocating the vm_dev struct with devres totally breaks this protection, though. Instead of waiting for the vm_dev release callback, the memory is freed when the platform_device is removed. Resulting in a use-after-free when finally the callback is to be called. To easily see the problem, compile the kernel with CONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs. The fix is easy, don't use devres in this case. Found during my research about object lifetime problems.

• linux linux kernel (>= 4.15.1 < 4.19.293) • linux linux kernel (>= 4.20 < 5.4.255) • linux linux kernel (>= 5.5 < 5.10.192) • linux linux kernel (>= 5.11 < 5.15.128) • linux linux kernel (>= 5.16 < 6.1.47) • linux linux kernel (>= 6.2 < 6.4.12) • linux linux kernel 4.15 • linux linux kernel 6.5