CVE-2023-52468

What it actually does

A use-after-free vulnerability occurs in class_register() because the lock_class_key remains registered in lock_keys_hash after subsys_private is freed in an error handler, allowing subsequent iteration over the hash to access freed memory when lockdep is enabled.

Why it matters to the business

Systems running debug kernels with lockdep enabled may experience crashes or potential memory corruption during driver initialization failures, leading to system instability, though this is uncommon in production environments.

How an attack unfolds

An attacker with local access loads a kernel module or driver that attempts to register a class with a duplicate name, triggering the error path and freeing the structure while the lock key is still hashed, leading to invalid memory access on subsequent operations.

How to fix it

Upgrade to a kernel version containing commit b57196a5ec5e4c0ffecde8348b085b778c7dce04 which unregisters the lock_class_key before freeing.

How to confirm the fix worked

Verify the presence of the fix commit in the kernel source; test by attempting duplicate class registration with lockdep enabled and confirm no invalid access reports.

Typical attack path

1. Local user initiates module load or driver init that causes duplicate class name registration
2. Error handler frees subsys_private without unregistering lock_class_key
3. Subsequent lockdep operations iterate hash and access freed memory
4. Potential for kernel panic or exploitation if conditions allow

How to detect it

Look for KASAN or lockdep reports mentioning lockdep_register_key or class_register in kernel logs; check for modprobe or init_module crashes around duplicate filename errors.

• lockdep_register_key+0x19c/0x1bc
• class_register+0x94/0x1ec
• BUG: KASAN: invalid-access in lockdep_register_key

What your security team should do

• Apply the kernel patch or upgrade to fixed version immediately if using debug configurations
• Avoid enabling lockdep in production kernels
• Monitor for kernel oops or KASAN reports related to lockdep_register_key