CVE-2023-52509: ravb: Fix use-after-free issue in ravb_tx_timeout_work()
In the Linux kernel, the following vulnerability has been resolved:
ravb: Fix use-after-free issue in ravbtxtimeoutwork()
The ravbstop() should call cancelworksync(). Otherwise, ravbtxtimeoutwork() is possible to use the freed priv after ravbremove() was called like below:
CPU0 CPU1 ravbtxtimeout() ravbremove() unregisternetdev() freenetdev(ndev) // free priv ravbtxtimeoutwork() // use priv
unregisternetdev() will call .ndostop() so that ravbstop() is called. And, after phystop() is called, netifcarrieroff() is also called. So that .ndotxtimeout() will not be called after phystop().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Configuration
Update the ravb driver so that ravb_stop() calls cancel_work_sync() to prevent use-after-free in ravb_tx_timeout_work() after ravb_remove() / unregister_netdev().
Linux kernel ravb driver ravb_stop() = call cancel_work_sync()
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52509?
CVE-2023-52509 has been classified as a medium severity vulnerability.
How do I fix CVE-2023-52509?
To fix CVE-2023-52509, update the Linux kernel to a version that contains the patch for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2023-52509?
CVE-2023-52509 affects various versions of the Linux kernel ranging from 4.2 to 6.6-rc5.
What type of vulnerability is CVE-2023-52509?
CVE-2023-52509 is a use-after-free vulnerability that can lead to memory corruption.
What component of the Linux kernel is impacted by CVE-2023-52509?
CVE-2023-52509 impacts the ravb (RAVB Ethernet driver) component within the Linux kernel.