CVE-2023-52795

What it actually does

Use-after-free and double-free in vhost_vdpa_probe() because put_device() invokes vhost_vdpa_release_dev() which performs ida_simple_remove() and frees the device structure before the second ida_simple_remove() executes on the already-freed pointer.

Why it matters to the business

Potential kernel crashes, memory corruption, or local privilege escalation on systems using the vhost-vdpa driver; low public exploit activity reduces immediate ransomware risk but still requires prompt patching on affected Linux deployments.

How an attack unfolds

An attacker with local access triggers vhost_vdpa_probe() under conditions that cause the device release path to free the structure, then reuses the dangling pointer via the subsequent ida_simple_remove() call; referenced Android kernel RCE techniques illustrate similar patterns that could be adapted for local exploitation.

How to fix it

Update to a kernel containing the fix for CVE-2023-52795; for snipe/snipe-it (GIT) deployments apply commit eea2eabaeef16fc8f3a1d61b19c06e9fc8ed942a or later.

How to confirm the fix worked

Confirm the patched kernel version is running, review dmesg or kernel logs for absence of vhost_vdpa related warnings, and verify ida_simple_remove() calls occur only on valid structures via code inspection or dynamic tracing.

Typical attack path

1. Obtain local access on a system running a vulnerable kernel with vhost-vdpa enabled
2. Trigger device probe and release sequence to induce the use-after-free
3. Leverage freed memory for corruption or code execution primitives
4. Escalate privileges or cause denial of service

How to detect it

Search kernel logs and audit trails for repeated vhost_vdpa_probe failures, unexpected device release sequences, or oops/panic messages referencing ida_simple_remove or vhost_vdpa_release_dev; correlate with process activity attempting to attach vhost devices.

• vhost_vdpa_release_dev
• ida_simple_remove
• vhost_vdpa_probe

What your security team should do

• Prioritize kernel updates on any hosts exposing vhost-vdpa functionality
• Audit systems for vhost-vdpa usage and schedule patching before any public exploit emergence
• Monitor EPSS and KEV feeds for changes in exploit maturity