{"id":"DEBIAN-CVE-2023-52922","details":"In the Linux kernel, the following vulnerability has been resolved:  can: bcm: Fix UAF in bcm_proc_show()  BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80 Read of size 8 at addr ffff888155846230 by task cat/7862  CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace:  \u003cTASK\u003e  dump_stack_lvl+0xd5/0x150  print_report+0xc1/0x5e0  kasan_report+0xba/0xf0  bcm_proc_show+0x969/0xa80  seq_read_iter+0x4f6/0x1260  seq_read+0x165/0x210  proc_reg_read+0x227/0x300  vfs_read+0x1d5/0x8d0  ksys_read+0x11e/0x240  do_syscall_64+0x35/0xb0  entry_SYSCALL_64_after_hwframe+0x63/0xcd  Allocated by task 7846:  kasan_save_stack+0x1e/0x40  kasan_set_track+0x21/0x30  __kasan_kmalloc+0x9e/0xa0  bcm_sendmsg+0x264b/0x44e0  sock_sendmsg+0xda/0x180  ____sys_sendmsg+0x735/0x920  ___sys_sendmsg+0x11d/0x1b0  __sys_sendmsg+0xfa/0x1d0  do_syscall_64+0x35/0xb0  entry_SYSCALL_64_after_hwframe+0x63/0xcd  Freed by task 7846:  kasan_save_stack+0x1e/0x40  kasan_set_track+0x21/0x30  kasan_save_free_info+0x27/0x40  ____kasan_slab_free+0x161/0x1c0  slab_free_freelist_hook+0x119/0x220  __kmem_cache_free+0xb4/0x2e0  rcu_core+0x809/0x1bd0  bcm_op is freed before procfs entry be removed in bcm_release(), this lead to bcm_proc_show() may read the freed bcm_op.","modified":"2026-09-15T09:02:49.150571869Z","published":"2024-11-28T15:15:17.260Z","upstream":["CVE-2023-52922"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-52922"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.52-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-52922.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.11-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-52922.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.11-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-52922.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}