CVE-2023-4387: Kernel: vmxnet3: use-after-free in vmxnet3_rq_alloc_rx_buf()
A use-after-free flaw was found in vmxnet3rqallocrxbuf in drivers/net/vmxnet3/vmxnet3drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This flaw could allow a local attacker to crash the system due to a double free while cleanup at vmxnet3rqcleanupall. This vulnerability could even lead to a kernel information leak problem.
In vmxnet3rqallocrxbuf(), when dmamapsingle() fails, rbi->skb is freed immediately. Similarly, in another branch, when dmamappage() fails, rbi->page is also freed. In the two cases, vmxnet3rqallocrxbuf() returns an error to its callers vmxnet3rqinit() -> vmxnet3rqinitall() -> vmxnet3activatedev(). Then vmxnet3activatedev() calls vmxnet3rqcleanupall() in error handling code, and rbi->skb or rbi->page are freed again in vmxnet3rqcleanupall(), causing use-after-free bugs.
References: https://github.com/torvalds/linux/commit/9e7fef9521e73ca8afd7da9e58c14654b02dfad8
Other sources
A use-after-free flaw was found in vmxnet3rqallocrxbuf in drivers/net/vmxnet3/vmxnet3drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3rqcleanupall, which could also lead to a kernel information leak problem.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 5.18
Event History
Frequently Asked Questions
What is the severity of CVE-2023-4387?
CVE-2023-4387 is classified as a high-severity vulnerability due to its potential to cause system crashes.
How do I fix CVE-2023-4387?
To fix CVE-2023-4387, you should upgrade to the latest kernel versions or specific patched versions mentioned in security advisories.
Which systems are affected by CVE-2023-4387?
CVE-2023-4387 affects various versions of the Linux Kernel, specifically between versions 3.16 and 5.18, including certain Red Hat Enterprise Linux versions.
What type of vulnerability is CVE-2023-4387?
CVE-2023-4387 is a use-after-free vulnerability that can lead to a double free condition during system operation.
Who can exploit CVE-2023-4387?
CVE-2023-4387 can potentially be exploited by local attackers with access to the affected system.