302 lines
15 KiB
JSON
302 lines
15 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2023-52509",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2024-02-20T12:30:33.315Z",
|
|
"datePublished": "2024-03-02T21:52:22.006Z",
|
|
"dateUpdated": "2026-08-05T09:10:18.221Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T09:10:18.221Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nravb: Fix use-after-free issue in ravb_tx_timeout_work()\n\nThe ravb_stop() should call cancel_work_sync(). Otherwise,\nravb_tx_timeout_work() is possible to use the freed priv after\nravb_remove() was called like below:\n\nCPU0\t\t\tCPU1\n\t\t\travb_tx_timeout()\nravb_remove()\nunregister_netdev()\nfree_netdev(ndev)\n// free priv\n\t\t\travb_tx_timeout_work()\n\t\t\t// use priv\n\nunregister_netdev() will call .ndo_stop() so that ravb_stop() is\ncalled. And, after phy_stop() is called, netif_carrier_off()\nis also called. So that .ndo_tx_timeout() will not be called\nafter phy_stop()."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The UAF is triggered when local teardown (ravb_close via ip link down, system suspend, or ravb_remove/unbind) races with locally scheduled ravb_tx_timeout_work; remote packets alone cannot free priv or cancel the work.\nAC:L - Once TX-timeout work is queued, the attacker (or routine automotive autosuspend) fully controls when close/remove runs, and ravb_stop_dma inside the worker creates a wide, repeatable window overlapping teardown without relying on an uncontrolled memory layout.\nPR:L - On Renesas R-Car embedded/automotive deployments, ordinary socket traffic arms the timeout path and system autosleep/idle suspend invokes ravb_close without CAP_NET_ADMIN; the same close-vs-work UAF needs no platform unbind/root, matching the CVE-2025-21801 ravb scoring precedent.\nUI:N - Traffic generation and interface/suspend teardown are driven by the attacker or by automatic power-management on the affected platforms; no separate victim user action is required.\nS:U - The use-after-free corrupts host-kernel heap/DMA objects (ravb_private, descriptor rings) within a single kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - ravb_tx_timeout_work continues to dereference priv and ring/skb pointers after free_netdev or ravb_ring_free, so reclaiming those slabs yields an arbitrary kernel-memory read primitive.\nI:H - The same UAF/double-free path re-enters ravb_ring_free/ravb_dmac_init on attacker-reclaimable objects (including work_struct and DMA state), enabling heap corruption and control-flow hijacking.\nA:H - Use-after-free of priv or double-free of DMA rings causes kernel oops/panic and takes down the primary Ethernet interface, as is typical for this race class."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ethernet/renesas/ravb_main.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "c156633f1353264634135dea86ffcae74f2122fc",
|
|
"lessThan": "65d34cfd4e347054eb4193bc95d9da7eaa72dee5",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "c156633f1353264634135dea86ffcae74f2122fc",
|
|
"lessThan": "db9aafa19547833240f58c2998aed7baf414dc82",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "c156633f1353264634135dea86ffcae74f2122fc",
|
|
"lessThan": "616761cf9df9af838c0a1a1232a69322a9eb67e6",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "c156633f1353264634135dea86ffcae74f2122fc",
|
|
"lessThan": "6f6fa8061f756aedb93af12a8a5d3cf659127965",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "c156633f1353264634135dea86ffcae74f2122fc",
|
|
"lessThan": "105abd68ad8f781985113aee2e92e0702b133705",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "c156633f1353264634135dea86ffcae74f2122fc",
|
|
"lessThan": "3971442870713de527684398416970cf025b4f89",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ethernet/renesas/ravb_main.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.2",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.2",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.4.259",
|
|
"lessThanOrEqual": "5.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.199",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.136",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.59",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.5.8",
|
|
"lessThanOrEqual": "6.5.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.2",
|
|
"versionEndExcluding": "5.4.259"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.2",
|
|
"versionEndExcluding": "5.10.199"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.2",
|
|
"versionEndExcluding": "5.15.136"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.2",
|
|
"versionEndExcluding": "6.1.59"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.2",
|
|
"versionEndExcluding": "6.5.8"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.2",
|
|
"versionEndExcluding": "6.6"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/65d34cfd4e347054eb4193bc95d9da7eaa72dee5"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/db9aafa19547833240f58c2998aed7baf414dc82"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/616761cf9df9af838c0a1a1232a69322a9eb67e6"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6f6fa8061f756aedb93af12a8a5d3cf659127965"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/105abd68ad8f781985113aee2e92e0702b133705"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3971442870713de527684398416970cf025b4f89"
|
|
}
|
|
],
|
|
"title": "ravb: Fix use-after-free issue in ravb_tx_timeout_work()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2024-07-24T20:38:43.674426Z",
|
|
"id": "CVE-2023-52509",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2024-07-24T20:38:50.426Z"
|
|
}
|
|
},
|
|
{
|
|
"providerMetadata": {
|
|
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"shortName": "CVE",
|
|
"dateUpdated": "2024-08-02T23:03:20.848Z"
|
|
},
|
|
"title": "CVE Program Container",
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/65d34cfd4e347054eb4193bc95d9da7eaa72dee5",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/db9aafa19547833240f58c2998aed7baf414dc82",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/616761cf9df9af838c0a1a1232a69322a9eb67e6",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6f6fa8061f756aedb93af12a8a5d3cf659127965",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/105abd68ad8f781985113aee2e92e0702b133705",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3971442870713de527684398416970cf025b4f89",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |