CVE-2023-53556

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: iavf: Fix use-after-free in free_netdev We do netif_napi_add() for all allocated q_vectors[], but potentially do netif_napi_del() for part of them, then kfree q_vectors and leave invalid pointers at dev->napi_list. Reproducer: [root@host ~]# cat repro.sh #!/bin/bash pf_dbsf="0000:41:00.0" vf0_dbsf="0000:41:02.0" g_pids=() function do_set_numvf() { echo 2 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs sleep $((RANDOM%3+1)) echo 0 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs sleep $((RANDOM%3+1)) } function do_set_channel() {...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 5eae00c57f5e42bf201023471917da213c4946d6 < 17046107ca15d7571551539d94e76aba2bf71fd3, >= 5eae00c57f5e42bf201023471917da213c4946d6 < a4635f190f332304db4a49e827ece790b804b5db, >= 5eae00c57f5e42bf201023471917da213c4946d6 < 345c44e18cc10cded85cb9134830e1684495c866, >= 5eae00c57f5e42bf201023471917da213c4946d6 < ca12b98e04b5d1902ac08fe826d3500cb4b6e891, >= 5eae00c57f5e42bf201023471917da213c4946d6 < 8d781a9c53034813c3194b7d94409c7d24ac73eb, >= 5eae00c57f5e42bf201023471917da213c4946d6 < 5f4fa1672d98fe99d2297b03add35346f1685d6b, >= 3.14, >= 3.14 < 5.4.251, >= 5.5 < 5.10.188, >= 5.11 < 5.15.123, >= 5.16 < 6.1.42, >= 6.2 < 6.4.7, 6.5

Fixed versions

5.4.251, 5.10.188, 5.15.123, 6.1.42, 6.4.7

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416