4.4

CVE-2023-52617: debian debian_linux Incomplete Cleanup

CVSS: 4.4v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2023-52617DEBIAN-CVE-2023-52617
Published 18-03-2024Last modified 11-05-2026
Open JSON

Vulnerability summary

CVE-2023-52617 is a medium (CVSS 4.4) Incomplete Cleanup vulnerability in debian debian_linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.7% of scored vulnerabilities.

Overall risk
18/100
0100
Low · default modelHow is this calculated?
CVSS score
4.4/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.24%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 18 · Related 19
DLA-3842-1DSA-5681-1SUSE-SU-2024:1466-1SUSE-SU-2024:1480-1SUSE-SU-2024:1490-1USN-6766-1

Timeline

  1. 18-03-2024
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: PCI: switchtec: Fix stdev_release() crash after surprise hot remove A PCI device hot removal may occur while stdev->cdev is held open. The call to stdev_release() then happens during close or exit, at a point way past switchtec_pci_remove(). Otherwise the last ref would vanish with the trailing put_device(), just before return. At that later point in time, the devm cleanup has already removed the stdev->mmio_mrpc mapping. Also, the stdev->pdev reference was not a counted one. Therefore, in DMA mode, the iowrite32() in stdev_release() will cause a fatal page fault, and the subsequent dma_free_coherent(), if reached, would pass a stale &stdev->pdev->dev pointer. Fix by moving MRPC DMA shutdown into switchtec_pci_remove(), after stdev_kill(). Counting the stdev->pdev ref is now optional, but may prevent future accidents. Reproducible via the script at https://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.24%

Chance of exploitation in the next 30 days

Percentile

14%

Versus all other CVEs

30-day change

0.00 pp

From 0.24% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.24%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu117 products
  • linuxAll versions (No fix recorded) | < 5.4.0-181.201 | < 5.15.0-106.116
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.4.0-1124.134 | < 5.15.0-1061.67
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
Linux2 products
  • linux≥ f7eb7b8a4f72b0d9dea69b09f58185ffab97fd35, < d8c293549946ee5078ed0ab77793cec365559355 | ≥ f7eb7b8a4f72b0d9dea69b09f58185ffab97fd35, < 4a5d0528cf19dbf060313dffbe047bc11c90c24c | ≥ f7eb7b8a4f72b0d9dea69b09f58185ffab97fd35, < ff1c7e2fb9e9c3f53715fbe04d3ac47b80be7eb8 | ≥ f7eb7b8a4f72b0d9dea69b09f58185ffab97fd35, < 1d83c85922647758c1f1e4806a4c5c3cf591a20a | ≥ f7eb7b8a4f72b0d9dea69b09f58185ffab97fd35, < 0233b836312e39a3c763fb53512b3fa455b473b3 | ≥ f7eb7b8a4f72b0d9dea69b09f58185ffab97fd35, < e129c7fa7070fbce57feb0bfc5eaa65eef44b693 | ≥ f7eb7b8a4f72b0d9dea69b09f58185ffab97fd35, < df25461119d987b8c81d232cfe4411e91dcabe66 | 5.0
  • linux_kernel< 5.4.269 | ≥ 5.5, < 5.10.210 | ≥ 5.11, < 5.15.149 | ≥ 5.16, < 6.1.77 | ≥ 6.2, < 6.6.16 | ≥ 6.7, < 6.7.4

3 vendors · 121 products

References

27 links
Show all 27 references