CVE-2023-52922: can: bcm: Fix UAF in bcm_proc_show()

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• linux linux kernel2.6.25 and later · before 4.14.322
• linux linux kernel4.15 and later · before 4.19.291
• linux linux kernel4.20 and later · before 5.4.251
• linux linux kernel5.5 and later · before 5.10.188
• linux linux kernel5.11 and later · before 5.15.123
• linux linux kernel5.16 and later · before 6.1.42
• linux linux kernel6.2 and later · before 6.4.7
• linux linux kernel6.5

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 2.6.25affected
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 and later · before 11b8e27ed448baa385d90154a141466bd5e92f18affected · git
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 and later · before 9b58d36d0c1ea29a9571e0222a9c29df0ccfb7ffaffected · git
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 and later · before 9533dbfac0ff7edd77a5fa2c24974b1d66c8b0a6affected · git
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 and later · before cf254b4f68e480e73dab055014e002b77aed30edaffected · git
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 and later · before 3c3941bb1eb53abe7d640ffee5c4d6b559829ab3affected · git
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 and later · before 995f47d76647708ec26c6e388663ad4f3f264787affected · git
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 and later · before dfd0aa26e9a07f2ce546ccf8304ead6a2914e8a7affected · git
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 and later · before 55c3b96074f3f9b0aee19bf93cd71af7516582bbaffected · git
  • before 2.6.25not affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2024-53100Nov 25, 2024 · nvme: tcp: avoid race between queue_lock lock and destroy
  18Monitor
• ← EarlierCVE-2024-53101Nov 25, 2024 · fs: Fix uninitialized value issue in from_kuid and from_kgid
  22Monitor
• Later →CVE-2024-53103Dec 2, 2024 · hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
  31Monitor

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.