Executive brief
The Linux kernel's IMX clock driver contains a use-after-free vulnerability in its clock unregistration routine. When the system unregisters clocks, the code frees memory while iterating through a list, causing the code to reference freed data when accessing the next item. An attacker with local access could exploit this to trigger a kernel crash or potentially execute arbitrary code.
Technical details
This is a use-after-free vulnerability in drivers/clk/imx/clk-scu.c in the imx_clk_scu_unregister() function. The vulnerable code uses list_for_each_entry() to iterate a linked list while freeing each entry via kfree(clk) within the loop. Since the list iterator dereferences the current entry to obtain the next entry after freeing it, this results in a use-after-free condition. The fix is to switch to list_for_each_entry_safe(), which safely stores the next list entry before the current entry is freed. This vulnerability is triggered locally during clock unregistration and requires kernel execution context, but can cause a kernel panic or memory corruption.
Affected products
- Linux Linux kernel multiple stable branches (v5.x, v6.x affected)
Timeline
- 2023-04-19: disclosed
- 2023-07-19: patched
- 2025-10-04: other: CVE-2023-53572 published to NVD