CVE-2023-52847 (GCVE-0-2023-52847)
Vulnerability from cvelistv5
Published
2024-05-21 15:31
Modified
2026-08-05 09:11
Summary
In the Linux kernel, the following vulnerability has been resolved: media: bttv: fix use after free error due to btv->timeout timer There may be some a race condition between timer function bttv_irq_timeout and bttv_remove. The timer is setup in probe and there is no timer_delete operation in remove function. When it hit kfree btv, the function might still be invoked, which will cause use after free bug. This bug is found by static analysis, it may be false positive. Fix it by adding del_timer_sync invoking to the remove function. cpu0 cpu1 bttv_probe ->timer_setup ->bttv_set_dma ->mod_timer; bttv_remove ->kfree(btv); ->bttv_irq_timeout ->USE btv
Impacted products
Vendor Product Version
Linux Linux Version: 162e6376ac58440beb6a2d2ee294f5d88ea58dd1
Version: 162e6376ac58440beb6a2d2ee294f5d88ea58dd1
Version: 162e6376ac58440beb6a2d2ee294f5d88ea58dd1
Version: 162e6376ac58440beb6a2d2ee294f5d88ea58dd1
Version: 162e6376ac58440beb6a2d2ee294f5d88ea58dd1
Version: 162e6376ac58440beb6a2d2ee294f5d88ea58dd1
Version: 162e6376ac58440beb6a2d2ee294f5d88ea58dd1
Version: 162e6376ac58440beb6a2d2ee294f5d88ea58dd1
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52847",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-10T19:17:00.085705Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-18T19:41:06.842Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:36.080Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b35fdade92c5058a5e727e233fe263b828de2c9a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2f3d9198cdae1cb079ec8652f4defacd481eab2b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/51c94256a83fe4e17406c66ff3e1ad7d242d8574"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/20568d06f6069cb835e05eed432edf962645d226"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1871014d6ef4812ad11ef7d838d73ce09d632267"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/847599fffa528b2cdec4e21b6bf7586dad982132"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bd5b50b329e850d467e7bcc07b2b6bde3752fbda"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/pci/bt8xx/bttv-driver.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9",
              "status": "affected",
              "version": "162e6376ac58440beb6a2d2ee294f5d88ea58dd1",
              "versionType": "git"
            },
            {
              "lessThan": "b35fdade92c5058a5e727e233fe263b828de2c9a",
              "status": "affected",
              "version": "162e6376ac58440beb6a2d2ee294f5d88ea58dd1",
              "versionType": "git"
            },
            {
              "lessThan": "2f3d9198cdae1cb079ec8652f4defacd481eab2b",
              "status": "affected",
              "version": "162e6376ac58440beb6a2d2ee294f5d88ea58dd1",
              "versionType": "git"
            },
            {
              "lessThan": "51c94256a83fe4e17406c66ff3e1ad7d242d8574",
              "status": "affected",
              "version": "162e6376ac58440beb6a2d2ee294f5d88ea58dd1",
              "versionType": "git"
            },
            {
              "lessThan": "20568d06f6069cb835e05eed432edf962645d226",
              "status": "affected",
              "version": "162e6376ac58440beb6a2d2ee294f5d88ea58dd1",
              "versionType": "git"
            },
            {
              "lessThan": "1871014d6ef4812ad11ef7d838d73ce09d632267",
              "status": "affected",
              "version": "162e6376ac58440beb6a2d2ee294f5d88ea58dd1",
              "versionType": "git"
            },
            {
              "lessThan": "847599fffa528b2cdec4e21b6bf7586dad982132",
              "status": "affected",
              "version": "162e6376ac58440beb6a2d2ee294f5d88ea58dd1",
              "versionType": "git"
            },
            {
              "lessThan": "bd5b50b329e850d467e7bcc07b2b6bde3752fbda",
              "status": "affected",
              "version": "162e6376ac58440beb6a2d2ee294f5d88ea58dd1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/pci/bt8xx/bttv-driver.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.299",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.201",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.139",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.7",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.299",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.261",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.201",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.139",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.63",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.12",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.2",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: bttv: fix use after free error due to btv-\u003etimeout timer\n\nThere may be some a race condition between timer function\nbttv_irq_timeout and bttv_remove. The timer is setup in\nprobe and there is no timer_delete operation in remove\nfunction. When it hit kfree btv, the function might still be\ninvoked, which will cause use after free bug.\n\nThis bug is found by static analysis, it may be false positive.\n\nFix it by adding del_timer_sync invoking to the remove function.\n\ncpu0                cpu1\n                  bttv_probe\n                    -\u003etimer_setup\n                      -\u003ebttv_set_dma\n                        -\u003emod_timer;\nbttv_remove\n  -\u003ekfree(btv);\n                  -\u003ebttv_irq_timeout\n                    -\u003eUSE btv"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached only through the local PCI remove path (bttv_remove \u2192 kfree(btv)) while btv-\u003etimeout may still fire; that is driver unbind/module unload or local hot-remove on a Bt8xx card, not a network or adjacent-link surface.\nAC:L - An attacker who starts V4L2 capture (buffer_queue \u2192 bttv_set_dma \u2192 mod_timer) while triggering remove controls both sides of the race against bttv_irq_timeout; remove never cancelled the timer before the fix, so the overlap is attacker-driven and retryable.\nPR:L - Arming the timer needs only /dev/video* access (udev group video); driver unbind/unload on an already-present card is scored Low consistent with the same-class media timer-UAF CVE-2023-53219 and the prefer-higher-severity rule.\nUI:N - The attacker starts streaming and initiates driver removal themselves; no separate victim action such as opening attacker-supplied content is required.\nS:U - The freed struct bttv (with embedded timer_list) is ordinary host-kernel heap under the same authority; there is no VM escape, IOMMU bypass, or sandbox boundary crossed.\nC:H - bttv_irq_timeout derives btv via from_timer and reads freed fields (curr, cvbi, capture lists, locks); UAF reclaim enables arbitrary kernel disclosure, scored High per UAF guidance.\nI:H - The handler takes btv-\u003es_lock and mutates curr/cvbi/capture/vcapture and DMA state on freed memory, yielding heap-spray write and control-flow hijack primitives typical of kernel UAFs.\nA:H - A use-after-free timer firing against kfree\u0027d btv reliably causes kernel oops/panic even when not fully exploited, which is Availability High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:11:40.867Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/b35fdade92c5058a5e727e233fe263b828de2c9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f3d9198cdae1cb079ec8652f4defacd481eab2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/51c94256a83fe4e17406c66ff3e1ad7d242d8574"
        },
        {
          "url": "https://git.kernel.org/stable/c/20568d06f6069cb835e05eed432edf962645d226"
        },
        {
          "url": "https://git.kernel.org/stable/c/1871014d6ef4812ad11ef7d838d73ce09d632267"
        },
        {
          "url": "https://git.kernel.org/stable/c/847599fffa528b2cdec4e21b6bf7586dad982132"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd5b50b329e850d467e7bcc07b2b6bde3752fbda"
        }
      ],
      "title": "media: bttv: fix use after free error due to btv-\u003etimeout timer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52847",
    "datePublished": "2024-05-21T15:31:44.513Z",
    "dateReserved": "2024-05-21T15:19:24.255Z",
    "dateUpdated": "2026-08-05T09:11:40.867Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b35fdade92c5058a5e727e233fe263b828de2c9a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2f3d9198cdae1cb079ec8652f4defacd481eab2b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/51c94256a83fe4e17406c66ff3e1ad7d242d8574\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/20568d06f6069cb835e05eed432edf962645d226\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1871014d6ef4812ad11ef7d838d73ce09d632267\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/847599fffa528b2cdec4e21b6bf7586dad982132\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bd5b50b329e850d467e7bcc07b2b6bde3752fbda\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:11:36.080Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52847\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-10T19:17:00.085705Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-18T19:41:03.187Z\"}}], \"cna\": {\"title\": \"media: bttv: fix use after free error due to btv-\u003etimeout timer\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The UAF is reached only through the local PCI remove path (bttv_remove \\u2192 kfree(btv)) while btv-\u003etimeout may still fire; that is driver unbind/module unload or local hot-remove on a Bt8xx card, not a network or adjacent-link surface.\\nAC:L - An attacker who starts V4L2 capture (buffer_queue \\u2192 bttv_set_dma \\u2192 mod_timer) while triggering remove controls both sides of the race against bttv_irq_timeout; remove never cancelled the timer before the fix, so the overlap is attacker-driven and retryable.\\nPR:L - Arming the timer needs only /dev/video* access (udev group video); driver unbind/unload on an already-present card is scored Low consistent with the same-class media timer-UAF CVE-2023-53219 and the prefer-higher-severity rule.\\nUI:N - The attacker starts streaming and initiates driver removal themselves; no separate victim action such as opening attacker-supplied content is required.\\nS:U - The freed struct bttv (with embedded timer_list) is ordinary host-kernel heap under the same authority; there is no VM escape, IOMMU bypass, or sandbox boundary crossed.\\nC:H - bttv_irq_timeout derives btv via from_timer and reads freed fields (curr, cvbi, capture lists, locks); UAF reclaim enables arbitrary kernel disclosure, scored High per UAF guidance.\\nI:H - The handler takes btv-\u003es_lock and mutates curr/cvbi/capture/vcapture and DMA state on freed memory, yielding heap-spray write and control-flow hijack primitives typical of kernel UAFs.\\nA:H - A use-after-free timer firing against kfree\u0027d btv reliably causes kernel oops/panic even when not fully exploited, which is Availability High.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"162e6376ac58440beb6a2d2ee294f5d88ea58dd1\", \"lessThan\": \"bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"162e6376ac58440beb6a2d2ee294f5d88ea58dd1\", \"lessThan\": \"b35fdade92c5058a5e727e233fe263b828de2c9a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"162e6376ac58440beb6a2d2ee294f5d88ea58dd1\", \"lessThan\": \"2f3d9198cdae1cb079ec8652f4defacd481eab2b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"162e6376ac58440beb6a2d2ee294f5d88ea58dd1\", \"lessThan\": \"51c94256a83fe4e17406c66ff3e1ad7d242d8574\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"162e6376ac58440beb6a2d2ee294f5d88ea58dd1\", \"lessThan\": \"20568d06f6069cb835e05eed432edf962645d226\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"162e6376ac58440beb6a2d2ee294f5d88ea58dd1\", \"lessThan\": \"1871014d6ef4812ad11ef7d838d73ce09d632267\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"162e6376ac58440beb6a2d2ee294f5d88ea58dd1\", \"lessThan\": \"847599fffa528b2cdec4e21b6bf7586dad982132\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"162e6376ac58440beb6a2d2ee294f5d88ea58dd1\", \"lessThan\": \"bd5b50b329e850d467e7bcc07b2b6bde3752fbda\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/media/pci/bt8xx/bttv-driver.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.299\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.261\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.201\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.139\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.63\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.5.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.5.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/media/pci/bt8xx/bttv-driver.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9\"}, {\"url\": \"https://git.kernel.org/stable/c/b35fdade92c5058a5e727e233fe263b828de2c9a\"}, {\"url\": \"https://git.kernel.org/stable/c/2f3d9198cdae1cb079ec8652f4defacd481eab2b\"}, {\"url\": \"https://git.kernel.org/stable/c/51c94256a83fe4e17406c66ff3e1ad7d242d8574\"}, {\"url\": \"https://git.kernel.org/stable/c/20568d06f6069cb835e05eed432edf962645d226\"}, {\"url\": \"https://git.kernel.org/stable/c/1871014d6ef4812ad11ef7d838d73ce09d632267\"}, {\"url\": \"https://git.kernel.org/stable/c/847599fffa528b2cdec4e21b6bf7586dad982132\"}, {\"url\": \"https://git.kernel.org/stable/c/bd5b50b329e850d467e7bcc07b2b6bde3752fbda\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: bttv: fix use after free error due to btv-\u003etimeout timer\\n\\nThere may be some a race condition between timer function\\nbttv_irq_timeout and bttv_remove. The timer is setup in\\nprobe and there is no timer_delete operation in remove\\nfunction. When it hit kfree btv, the function might still be\\ninvoked, which will cause use after free bug.\\n\\nThis bug is found by static analysis, it may be false positive.\\n\\nFix it by adding del_timer_sync invoking to the remove function.\\n\\ncpu0                cpu1\\n                  bttv_probe\\n                    -\u003etimer_setup\\n                      -\u003ebttv_set_dma\\n                        -\u003emod_timer;\\nbttv_remove\\n  -\u003ekfree(btv);\\n                  -\u003ebttv_irq_timeout\\n                    -\u003eUSE btv\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.299\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.261\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.201\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.139\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.63\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.5.12\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.2\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7\", \"versionStartIncluding\": \"4.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:11:40.867Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52847\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T09:11:40.867Z\", \"dateReserved\": \"2024-05-21T15:19:24.255Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T15:31:44.513Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…