NetSight
IP …
high7.8

CVE-2023-53189

In the Linux kernel, the following vulnerability has been resolved: ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_timer(), …

Impact

In the Linux kernel, the following vulnerability has been resolved: ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_timer(), reference idev depends on whether rs_timer is not pending. Then modify rs_timer timeout. There is a time gap in [1], during which if the pending rs_timer becomes not pending. It will miss to hold idev, but the rs_timer is activated. Thus rs_timer callback function addrconf_rs_timer() will be executed and put idev later without holding idev. A refcount underflow issue for idev can be caused by this. if (!timer_pending(&idev->rs_timer)) in6_dev_hold(idev); <--------------[1] mod_timer(&idev->rs_timer, jiffies + when); To fix the issue, hold idev if mod_timer() return 0.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 3.10.105 before 4.14.322
from 4.15 before 4.19.291
from 4.20 before 5.4.251
from 5.5 before 5.10.188
from 5.11 before 5.15.121
from 5.16 before 6.1.40

Weakness classification

CWE-191

References