CVE-2023-6039: Kernel: use-after-free in drivers/net/usb/lan78xx.c in lan78xx_disconnect
A use-after-free flaw was found in lan78xxdisconnect in drivers/net/usb/lan78xx.c in the network sub-component, net/usb/lan78xx in the Linux Kernel. This flaw allows a local attacker to crash the system when the LAN78XX USB device detaches.
Other sources
There are use-after-free vulnerabilities in drivers/net/usb/lan78xx.c of linux that allow attacker to crash linux kernel when LAN78XX USB device is detaching.
The timer dev->statmonitor can schedule the delayed work dev->wq and the delayed work dev->wq can also arm the dev->statmonitor timer.
When the device is detaching, the netdevice will be deallocated. But the netdevice private data could still be dereferenced in delayed work or timer handler. As a result, the UAF bugs will happen.
Refer: https://github.com/torvalds/linux/commit/1e7417c188d0a83fb385ba2dbe35fd2563f2b6f3
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-6039?
CVE-2023-6039 is a use-after-free vulnerability in the lan78xx_disconnect function in the drivers/net/usb/lan78xx.c file in the Linux Kernel.
What is the severity of CVE-2023-6039?
The severity of CVE-2023-6039 is medium with a score of 5.5.
How does CVE-2023-6039 affect Red Hat Kernel 6.5?
Red Hat Kernel 6.5 is affected by CVE-2023-6039.
How can a local attacker exploit CVE-2023-6039?
A local attacker can exploit CVE-2023-6039 by detaching the LAN78XX USB device, which causes a use-after-free flaw and may crash the system.
Where can I find more information about CVE-2023-6039?
More information about CVE-2023-6039 can be found at the Red Hat Security Advisory and the GitHub commit referenced in the description.