CVE-2023-52679

What it actually does

Double free vulnerability in of_parse_phandle_with_args_map() caused by missing NULL reset of 'new' pointer between outer loop iterations, leading to use-after-free and memory corruption in the Linux kernel device tree parser.

Why it matters to the business

Local attackers on affected Linux systems can achieve privilege escalation or kernel panic, potentially compromising servers, embedded devices, or Android-based products and forcing urgent kernel updates across large fleets.

How an attack unfolds

An attacker with local access crafts or supplies a malicious device tree blob that exercises the inner map-entry loop multiple times; the missing NULL assignment after the first iteration causes of_node_put() to be called on an already-freed node on the second iteration, resulting in a double-free that can be leveraged for arbitrary code execution.

How to fix it

Update the Linux kernel to commit 26b4d702c44f9e5cf3c5c001ae619a4a001889db or later; apply the corresponding stable or distribution kernel package that contains the fix; rebuild and redeploy any custom kernels or device-tree-dependent images.

How to confirm the fix worked

Confirm the presence of commit 26b4d702c44f9e5cf3c5c001ae619a4a001889db in the running kernel source or package changelog; run the extended device-tree unittests that now cover the double-free path; verify that of_parse_phandle_with_args_map() no longer exhibits the bug under the new test cases.

Typical attack path

1. Obtain local shell or user-level access on a vulnerable system
2. Prepare or load a device tree containing multiple phandle map entries that trigger repeated inner-loop execution
3. Invoke of_parse_phandle_with_args_map() via a kernel driver or userspace interface that parses the crafted tree
4. Trigger the double-free path to corrupt kernel memory structures
5. Escalate privileges or crash the kernel

How to detect it

Review kernel logs for repeated of_node_put() warnings or slab corruption messages around device-tree parsing; inspect audit logs for unusual local processes that load device trees; search for evidence of exploitation via crash dumps showing double-free in of_parse_phandle_with_args_map().

What your security team should do

• Prioritize kernel updates on all systems that parse external or untrusted device trees
• Audit custom device-tree loading code for similar pointer-handling patterns
• Monitor vendor advisories for backported fixes in LTS kernels
• Test the updated kernel with existing device-tree validation suites before broad rollout