CVE-2023-52664: net: atlantic: eliminate double free in error handling logic
In the Linux kernel, the following vulnerability has been resolved:
net: atlantic: eliminate double free in error handling logic
Driver has a logic leak in ring data allocation/free, where aqringfree could be called multiple times on same ring, if system is under stress and got memory allocation error.
Ring pointer was used as an indicator of failure, but this is not correct since only ring data is allocated/deallocated. Ring itself is an array member.
Changing ring allocation functions to return error code directly. This simplifies error handling and eliminates aqringfree on higher layer.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net: atlantic: eliminate double free in error handling logic
The Linux kernel CVE team has assigned CVE-2023-52664 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051756-CVE-2023-52664-dea1@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.77 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.16 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52664?
CVE-2023-52664 has a severity rating that indicates it could lead to a denial of service due to double free issues in the Linux kernel.
How do I fix CVE-2023-52664?
To mitigate CVE-2023-52664, update the kernel to versions 6.1.77, 6.6.16, 6.7.4, or 6.8 for Red Hat systems or to 5.10.223-1 or 5.10.226-1 for Debian systems.
What versions of the Linux kernel are affected by CVE-2023-52664?
CVE-2023-52664 affects Linux kernel versions prior to 6.1.77, between 6.2 and 6.6.16, and between 6.7 and 6.7.4.
What are the potential consequences of exploiting CVE-2023-52664?
Exploitation of CVE-2023-52664 may lead to denial of service conditions, impacting system stability and availability.
Is there a workaround for CVE-2023-52664?
Currently, the recommended approach to address CVE-2023-52664 is to apply the relevant security patches as there are no official workarounds.