NetSight
IP …
high7.8

CVE-2023-52509

In the Linux kernel, the following vulnerability has been resolved: ravb: Fix use-after-free issue in ravb_tx_timeout_work() The ravb_stop() should call cancel…

Impact

In the Linux kernel, the following vulnerability has been resolved: ravb: Fix use-after-free issue in ravb_tx_timeout_work() The ravb_stop() should call cancel_work_sync(). Otherwise, ravb_tx_timeout_work() is possible to use the freed priv after ravb_remove() was called like below: CPU0 CPU1 ravb_tx_timeout() ravb_remove() unregister_netdev() free_netdev(ndev) // free priv ravb_tx_timeout_work() // use priv unregister_netdev() will call .ndo_stop() so that ravb_stop() is called. And, after phy_stop() is called, netif_carrier_off() is also called. So that .ndo_tx_timeout() will not be called after phy_stop().

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.2 before 5.4.259
from 5.5 before 5.10.199
from 5.11 before 5.15.136
from 5.16 before 6.1.59
from 6.2 before 6.5.8
Version 6.6

Weakness classification

CWE-416

References