nvd-json-data-feeds/CVE-2023/CVE-2023-525xx/CVE-2023-52509.json

{
  "id": "CVE-2023-52509",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2024-03-02T22:15:47.540",
  "lastModified": "2024-03-04T13:58:23.447",
  "vulnStatus": "Awaiting Analysis",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nravb: Fix use-after-free issue in ravb_tx_timeout_work()\n\nThe ravb_stop() should call cancel_work_sync(). Otherwise,\nravb_tx_timeout_work() is possible to use the freed priv after\nravb_remove() was called like below:\n\nCPU0\t\t\tCPU1\n\t\t\travb_tx_timeout()\nravb_remove()\nunregister_netdev()\nfree_netdev(ndev)\n// free priv\n\t\t\travb_tx_timeout_work()\n\t\t\t// use priv\n\nunregister_netdev() will call .ndo_stop() so that ravb_stop() is\ncalled. And, after phy_stop() is called, netif_carrier_off()\nis also called. So that .ndo_tx_timeout() will not be called\nafter phy_stop()."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ravb: soluciona el problema de Use After Free en ravb_tx_timeout_work(). Ravb_stop() deber\u00eda llamar a cancel_work_sync(). De lo contrario, ravb_tx_timeout_work() es posible usar el privilegio liberado despu\u00e9s de que se llam\u00f3 a ravb_remove() como se muestra a continuaci\u00f3n: CPU0 CPU1 ravb_tx_timeout() ravb_remove() unregister_netdev() free_netdev(ndev) // priv libre ravb_tx_timeout_work() // usa priv unregister_netdev() llamar\u00e1 a .ndo_stop() para que se llame a ravb_stop(). Y, despu\u00e9s de llamar a phy_stop(), tambi\u00e9n se llama a netif_carrier_off(). De modo que .ndo_tx_timeout() no ser\u00e1 llamado despu\u00e9s de phy_stop()."
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/105abd68ad8f781985113aee2e92e0702b133705",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3971442870713de527684398416970cf025b4f89",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/616761cf9df9af838c0a1a1232a69322a9eb67e6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/65d34cfd4e347054eb4193bc95d9da7eaa72dee5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6f6fa8061f756aedb93af12a8a5d3cf659127965",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/db9aafa19547833240f58c2998aed7baf414dc82",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}