{"id":"DEBIAN-CVE-2023-53805","details":"In the Linux kernel, the following vulnerability has been resolved:  tty: n_gsm: fix UAF in gsm_cleanup_mux  In gsm_cleanup_mux() the 'gsm-\u003edlci' pointer was not cleaned properly, leaving it a dangling pointer after gsm_dlci_release. This leads to use-after-free where 'gsm-\u003edlci[0]' are freed and accessed by the subsequent gsm_cleanup_mux().  Such is the case in the following call trace:   \u003cTASK\u003e  __dump_stack lib/dump_stack.c:88 [inline]  dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106  print_address_description+0x63/0x3b0 mm/kasan/report.c:248  __kasan_report mm/kasan/report.c:434 [inline]  kasan_report+0x16b/0x1c0 mm/kasan/report.c:451  gsm_cleanup_mux+0x76a/0x850 drivers/tty/n_gsm.c:2397  gsm_config drivers/tty/n_gsm.c:2653 [inline]  gsmld_ioctl+0xaae/0x15b0 drivers/tty/n_gsm.c:2986  tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816  vfs_ioctl fs/ioctl.c:51 [inline]  __do_sys_ioctl fs/ioctl.c:874 [inline]  __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x61/0xcb  \u003c/TASK\u003e  Allocated by task 3501:  kasan_save_stack mm/kasan/common.c:38 [inline]  kasan_set_track mm/kasan/common.c:46 [inline]  set_alloc_info mm/kasan/common.c:434 [inline]  ____kasan_kmalloc+0xba/0xf0 mm/kasan/common.c:513  kasan_kmalloc include/linux/kasan.h:264 [inline]  kmem_cache_alloc_trace+0x143/0x290 mm/slub.c:3247  kmalloc include/linux/slab.h:591 [inline]  kzalloc include/linux/slab.h:721 [inline]  gsm_dlci_alloc+0x53/0x3a0 drivers/tty/n_gsm.c:1932  gsm_activate_mux+0x1c/0x330 drivers/tty/n_gsm.c:2438  gsm_config drivers/tty/n_gsm.c:2677 [inline]  gsmld_ioctl+0xd46/0x15b0 drivers/tty/n_gsm.c:2986  tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816  vfs_ioctl fs/ioctl.c:51 [inline]  __do_sys_ioctl fs/ioctl.c:874 [inline]  __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x61/0xcb  Freed by task 3501:  kasan_save_stack mm/kasan/common.c:38 [inline]  kasan_set_track+0x4b/0x80 mm/kasan/common.c:46  kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360  ____kasan_slab_free+0xd8/0x120 mm/kasan/common.c:366  kasan_slab_free include/linux/kasan.h:230 [inline]  slab_free_hook mm/slub.c:1705 [inline]  slab_free_freelist_hook+0xdd/0x160 mm/slub.c:1731  slab_free mm/slub.c:3499 [inline]  kfree+0xf1/0x270 mm/slub.c:4559  dlci_put drivers/tty/n_gsm.c:1988 [inline]  gsm_dlci_release drivers/tty/n_gsm.c:2021 [inline]  gsm_cleanup_mux+0x574/0x850 drivers/tty/n_gsm.c:2415  gsm_config drivers/tty/n_gsm.c:2653 [inline]  gsmld_ioctl+0xaae/0x15b0 drivers/tty/n_gsm.c:2986  tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816  vfs_ioctl fs/ioctl.c:51 [inline]  __do_sys_ioctl fs/ioctl.c:874 [inline]  __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x61/0xcb","modified":"2025-12-09T10:41:53.757735Z","published":"0001-01-01T00:00:00Z","withdrawn":"2025-12-09T10:41:53.757735Z","upstream":["CVE-2023-53805"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-53805"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:11","purl":"pkg:deb/debian/linux?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.191-1"}]}],"versions":["5.10.103-1","5.10.103-1~bpo10+1","5.10.106-1","5.10.113-1","5.10.120-1","5.10.120-1~bpo10+1","5.10.127-1","5.10.127-2","5.10.127-2~bpo10+1","5.10.136-1","5.10.140-1","5.10.148-1","5.10.149-1","5.10.149-2","5.10.158-1","5.10.158-2","5.10.162-1","5.10.178-1","5.10.178-2","5.10.178-3","5.10.179-1","5.10.179-2","5.10.179-3","5.10.179-4","5.10.179-5","5.10.46-4","5.10.46-5","5.10.70-1","5.10.70-1~bpo10+1","5.10.84-1","5.10.92-1","5.10.92-1~bpo10+1","5.10.92-2"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53805.json"}},{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.52-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53805.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.11-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53805.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.11-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53805.json"}}],"schema_version":"1.7.3"}