CVSS 7.8 · High EPSS 0,38%
Kerentanan Use After Free pada linux kernel. Skor CVSS 3.1 7.8 (High) menurut NVD.
In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixing CVE-2023-6270, f98364e92662 ("aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts") makes tx() calling dev_put() instead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs into use-after-free. Then Nicolai Stange found more places in aoe have potential use-after-free problem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe() and aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push packet to tx queue. So they should also use dev_hold() to increase the refcnt of skb->dev. On the other hand, moving dev_put() to tx() causes that the refcnt of skb->dev be reduced to a negative value, because corresponding dev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(), probe(), and aoecmd_cfg_rsp(). This patch fixed this issue.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 5.10.214 hingga sebelum 5.10.227 |
| linux | linux kernel | Versi 5.15.153 hingga sebelum 5.15.168 |
| linux | linux kernel | Versi 6.1.83 hingga sebelum 6.1.113 |
| linux | linux kernel | Versi 6.6.23 hingga sebelum 6.6.55 |
| linux | linux kernel | Versi 6.7.11 hingga sebelum 6.8.2 |
| linux | linux kernel | Versi 6.9 hingga sebelum 6.10.14 |
| linux | linux kernel | Versi 6.11 hingga sebelum 6.11.3 |
| linux | linux kernel | Versi 4.19.311 |
| linux | linux kernel | Versi 5.4.273 |
| linux | linux kernel | Versi 6.12 rc1 |