CVE-2023-52584

What it actually does

Use-after-free in the MediaTek SPMI pmif driver where spmi_controller (holding pmif driver data with clocks) is freed before devres cleanup of clocks via clk_bulk_put, causing access to already-freed memory on device remove.

Why it matters to the business

May cause kernel crashes or limited local memory corruption on systems using the affected MediaTek SPMI driver; low remote exploitability reduces broad operational risk but requires prompt kernel updates on embedded and server fleets to avoid stability issues.

How an attack unfolds

An attacker with local access triggers device removal (for example via module unload or hotplug) to free the spmi_controller first; subsequent clock put operations then reference the already-freed pmif data, leading to UAF. The issue is primarily a stability and local memory-safety flaw rather than a remote vector.

How to fix it

Update the Linux kernel to a version containing commit 521f28eedd6b14228c46e3b81e3bf9b90c2818d8 or later; rebuild and deploy the fixed kernel across affected systems. Disable DEBUG_TEST_DRIVER_REMOVE in production kernels.

How to confirm the fix worked

Confirm the running kernel contains commit 521f28eedd6b14228c46e3b81e3bf9b90c2818d8 or equivalent backport; attempt reproduction with DEBUG_TEST_DRIVER_REMOVE and KASAN enabled to verify the UAF is no longer triggered.

Typical attack path

1. Obtain local access or code execution on a Linux system using the mediatek SPMI driver
2. Trigger driver removal or device hot-unplug to invoke the faulty remove path
3. Cause the spmi_controller to be freed before clock resources are released
4. Trigger subsequent clock operations that dereference the freed pmif data

How to detect it

Review kernel logs for KASAN reports mentioning use-after-free in spmi or clk_bulk paths around device removal events; inspect dmesg or journalctl for mediatek pmif driver unload sequences coinciding with crashes.

What your security team should do

• Prioritize kernel upgrades on all systems exposing the mediatek SPMI driver within the next maintenance window
• Monitor upstream stable branches for the referenced commit and backport if using older LTS kernels
• Remove DEBUG_TEST_DRIVER_REMOVE from production kernel configurations