What is CVE-2023-52884?

CVE-2023-52884 is a Medium severity Linux kernel vulnerability with a CVSS score of 4.4 out of 10, classified as a Improper Locking flaw (CWE-667), affecting Linux kernel versions from 5.11 onward and patched in 5.15.161, 6.1.93, 6.6.33 and others. CVE-2023-52884 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2023-52884?

CVE-2023-52884 has a CVSS score of 4.4 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2023-52884?

Yes, CVE-2023-52884 has been patched. Fixed versions include 5.15.161, 6.1.93, 6.6.33 and others. If you are running Linux kernel 5.11 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2023-52884 actively exploited?

CVE-2023-52884 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Improper Locking (CWE-667)?

The product does not properly acquire or release a lock, which can lead to unexpected behaviour. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/667.html

CVE-2023-52884

Medium

In the Linux kernel, the following vulnerability has been resolved: Input: cyapa - add missing input core locking to suspend/resume functions Grab input->mutex during suspend/resume functions like it is done in other input drivers. This fixes the following warning during system suspend/resume cycle on Samsung Exynos5250-based Snow Chromebook: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 1680 at drivers/input/input.c:2291 input_device_enabled+0x68/0x6c Modules linked in: ... CPU: 1 PID: 1680 Comm: kworker/u4:12 Tainted: G W 6.6.0-rc5-next-20231009 #14109 Hardware name: Samsung Exynos (Flattened Device Tree) Workqueue: events_unbound async_run_entry_fn unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x58/0x70 dump_stack_lvl from __warn+0x1a8/0x1cc __warn from warn_slowpath_fmt+0x18c/0x1b4 warn_slowpath_fmt from input_device_enabled+0x68/0x6c input_device_enabled from cyapa_gen3_set_power_mode+0x13c/0x1dc cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c cyapa_reinitialize from cyapa_resume+0x48/0x98 cyapa_resume from dpm_run_callback+0x90/0x298 dpm_run_callback from device_resume+0xb4/0x258 device_resume from async_resume+0x20/0x64 async_resume from async_run_entry_fn+0x40/0x15c async_run_entry_fn from process_scheduled_works+0xbc/0x6a8 process_scheduled_works from worker_thread+0x188/0x454 worker_thread from kthread+0x108/0x140 kthread from ret_from_fork+0x14/0x28 Exception stack(0xf1625fb0 to 0xf1625ff8) ... ---[ end trace 0000000000000000 ]--- ... ------------[ cut here ]------------ WARNING: CPU: 1 PID: 1680 at drivers/input/input.c:2291 input_device_enabled+0x68/0x6c Modules linked in: ... CPU: 1 PID: 1680 Comm: kworker/u4:12 Tainted: G W 6.6.0-rc5-next-20231009 #14109 Hardware name: Samsung Exynos (Flattened Device Tree) Workqueue: events_unbound async_run_entry_fn unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x58/0x70 dump_stack_lvl from __warn+0x1a8/0x1cc __warn from warn_slowpath_fmt+0x18c/0x1b4 warn_slowpath_fmt from input_device_enabled+0x68/0x6c input_device_enabled from cyapa_gen3_set_power_mode+0x13c/0x1dc cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c cyapa_reinitialize from cyapa_resume+0x48/0x98 cyapa_resume from dpm_run_callback+0x90/0x298 dpm_run_callback from device_resume+0xb4/0x258 device_resume from async_resume+0x20/0x64 async_resume from async_run_entry_fn+0x40/0x15c async_run_entry_fn from process_scheduled_works+0xbc/0x6a8 process_scheduled_works from worker_thread+0x188/0x454 worker_thread from kthread+0x108/0x140 kthread from ret_from_fork+0x14/0x28 Exception stack(0xf1625fb0 to 0xf1625ff8) ... ---[ end trace 0000000000000000 ]---

Package Linux Kernel

Published 2024-06-21

Last modified 2025-03-24

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

4.4

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness type

CWE-667

CVE-2023-52884 is a Improper Locking vulnerability

What is Improper Locking?

The product does not properly acquire or release a lock, which can lead to unexpected behaviour. Learn more on MITRE CWE

Affected versions

Linux kernel versions 5.11 and later are affected. Fixed in 5.15.161, 6.1.93, 6.6.33, 6.9.4, 6.10 and their respective stable series.

Affected from

≥ 5.11

Fixed in

✓ 5.15.161 5.15.x ✓ 6.1.93 6.1.x ✓ 6.6.33 6.6.x ✓ 6.9.4 6.9.x ✓ 6.10

References

5 total

Kernel Git
https://git.kernel.org/stable/c/7b4e0b39182cf5e677c1fc092a3ec40e621c25b6

Patch
Kernel Git
https://git.kernel.org/stable/c/9400caf566f65c703e99d95f87b00c4b445627a7

Patch
Kernel Git
https://git.kernel.org/stable/c/a4c638ab25786bd5aab5978fe51b2b9be16a4ebd

Patch
Kernel Git
https://git.kernel.org/stable/c/a5fc298fa8f67cf1f0e1fc126eab70578cd40adc

Patch
Kernel Git
https://git.kernel.org/stable/c/f99809fdeb50d65bcbc1661ef391af94eebb8a75

Patch

Details

CVE ID CVE-2023-52884

Severity Medium

CVSS score 4.4 / 10

CVSS version 3.1

Published 2024-06-21

Modified 2025-03-24

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2023-52884?

CVE-2023-52884 is a Medium severity Linux kernel vulnerability with a CVSS score of 4.4 out of 10 , classified as an Improper Locking flaw (CWE-667) . It affects Linux kernel versions from 5.11 onward and has been patched in 5.15.161, 6.1.93, 6.6.33 and others. CVE-2023-52884 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2023-52884?

CVE-2023-52884 has a CVSS score of 4.4 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2023-52884?

Yes. CVE-2023-52884 has been patched. Fixed versions include 5.15.161, 6.1.93, 6.6.33 and others. If you are running Linux kernel 5.11 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2023-52884 actively exploited?

No. CVE-2023-52884 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.