CVE-2023-52589

Severity CVSS v4.0:
Pending analysis
Type:
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Publication date:
06/03/2024
Last modified:
14/02/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: rkisp1: Fix IRQ disable race issue<br /> <br /> In rkisp1_isp_stop() and rkisp1_csi_disable() the driver masks the<br /> interrupts and then apparently assumes that the interrupt handler won&amp;#39;t<br /> be running, and proceeds in the stop procedure. This is not the case, as<br /> the interrupt handler can already be running, which would lead to the<br /> ISP being disabled while the interrupt handler handling a captured<br /> frame.<br /> <br /> This brings up two issues: 1) the ISP could be powered off while the<br /> interrupt handler is still running and accessing registers, leading to<br /> board lockup, and 2) the interrupt handler code and the code that<br /> disables the streaming might do things that conflict.<br /> <br /> It is not clear to me if 2) causes a real issue, but 1) can be seen with<br /> a suitable delay (or printk in my case) in the interrupt handler,<br /> leading to board lockup.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.1.77 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.16 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.7.4 (excluding)