CVE-2023-52795: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52795 is a vulnerability discovered in the Linux kernel's vhost-vdpa component, specifically in the vhost_vdpa_probe() function. The vulnerability was disclosed on May 21, 2024, affecting Linux kernel versions from 6.0 up to 6.1.64, 6.2 up to 6.5.13, and 6.6 up to 6.6.3, as well as version 6.7 rc1 (NVD).

The vulnerability stems from a use-after-free condition in the vhost_vdpa_probe() function. The issue occurs when put_device() calls vhost_vdpa_release_dev(), which subsequently calls ida_simple_remove() and frees the 'v' variable. This sequence results in both a use-after-free condition and a double free vulnerability. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access requirements but high impact potential (NVD).

The vulnerability could potentially lead to system compromise through memory corruption, as both use-after-free and double free conditions can be exploited to execute arbitrary code or cause system crashes. The high CVSS score reflects the potential for complete compromise of system confidentiality, integrity, and availability if successfully exploited (NVD).

The vulnerability requires local access and low privileges to exploit. While the technical details of the vulnerability have been publicly disclosed, there are no public reports of this vulnerability being actively exploited in the wild (NVD).

A patch has been developed and committed to the Linux kernel to address this vulnerability. The fix involves removing the redundant ida_simple_remove() call in the error handling path of vhost_vdpa_probe() (Kernel Patch).