From bippy-4986f5686161 Mon Sep 17 00:00:00 2001 From: Lee Jones To: Reply-to: , Subject: CVE-2023-52496: mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters X-Developer-Signature: v=1; a=openpgp-sha256; l=2023; i=lee@kernel.org; h=from:subject; bh=isOcOKoYqqpRj3WSSsSyLa1dkVqsBjRfkDT3K8Vxwwk=; b=owEBbQKS/ZANAwAKAVGvii+H/HdhAcsmYgBl4KhOkNrVDv5FSHzPjsSHIiZUHkbRcWLf+ucf4 exYI8XQEvGJAjMEAAEKAB0WIQR2tsk1o74gmpTwh0hRr4ovh/x3YQUCZeCoTgAKCRBRr4ovh/x3 YQSaD/0YxpIe4hk3evamvTqStXCTDaaOvoIE3XM9w3k551pBpvbmKYU2Rg9qJ8YMF/l+uctRPaE RaIkDsajkdhuShb2hZVM6j1YqjuMK9kTw9elP9Q9/7mrIvUdbKot7tzwNegqzl1pAtDiEolOkd8 yfW0XlybVKU1XcsOSXpW3vgI07K8D41eJX/TFyeNMQW+hDsVmxcwYs7kxaOOsL7SyudqijWgPy+ Y7fAtXO1abtyHDwExrIzaoF0jP2rrsJ/Oj3rX4fVHilLLjieNXuwGb3YvxuQ9XXtEKVncSgp2ju YZHTZg9pbP7OWRvOd5jAKGq8YnxDKmIqisUyxEld1SUtGFYjuE0OH64Qv70C76cqlohpfu6/0Rz pInggeZRnj0+wDocnZuTgcCmhmf5vBXocS19XrTRJMiepB7lVN/k1leDR4e5N9xyO9nhk5gCNDQ 2hSmWWqstdMOsjcRY0UONPMUzsDIljeH9zrfbrA4Mh9ax7UuhVsjW6VDqbzvDS0/6UXeqp9ZSyf VtWtwM6OVDuL1m/qyn7u8bV19BouSrcYrZnmdqBpQHggHKoHdVYMarOSHnU/LYIbSo08QLoT08A SKt6PuFQ8NODY8e3EMLN4G1AfWj5izKfh/rluseSH81s2sTyYwhnZ+T334RRXhGwCZiOyJ0LLPF CdOC02jV714hpIg== X-Developer-Key: i=lee@kernel.org; a=openpgp; fpr=76B6C935A3BE209A94F0874851AF8A2F87FC7761 Description =========== In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters While switching to ref counters for track mtd devices use, the vmu-flash driver was forgotten. The reason for reading the ref counter seems debatable, but let's just fix the build for now. The Linux kernel CVE team has assigned CVE-2023-52496 to this issue. Affected and fixed versions =========================== Issue introduced in 6.6 with commit 19bfa9ebebb5 and fixed in 6.6.15 with commit 38c12f10990a Issue introduced in 6.6 with commit 19bfa9ebebb5 and fixed in 6.7.3 with commit 1168d6b79d2f Issue introduced in 6.6 with commit 19bfa9ebebb5 and fixed in 6.8-rc1 with commit a7d84a2e7663 Please see https://www.kernel.org or a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-52496 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/mtd/maps/vmu-flash.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/38c12f10990ad6e63ddef2f20c1b066e5e4d34fd https://git.kernel.org/stable/c/1168d6b79d2fafb41299fbc1b528e20644c562a5 https://git.kernel.org/stable/c/a7d84a2e7663bbe12394cc771107e04668ea313a