CVE-2023-52509

In the Linux kernel, the following vulnerability has been resolved:

ravb: Fix use-after-free issue in ravb_tx_timeout_work()

The ravb_stop() should call cancel_work_sync(). Otherwise, ravb_tx_timeout_work() is possible to use the freed priv after ravb_remove() was called like below:

CPU0 CPU1 ravb_tx_timeout() ravb_remove() unregister_netdev() free_netdev(ndev) // free priv ravb_tx_timeout_work() // use priv

unregister_netdev() will call .ndo_stop() so that ravb_stop() is called. And, after phy_stop() is called, netif_carrier_off() is also called. So that .ndo_tx_timeout() will not be called after phy_stop().

This vulnerability is rated as Low severity due to the requirement for specific Renesas hardware and elevated local privileges or physical interface access to trigger the teardown condition. The issue resides in the Renesas Ethernet AVB driver, which is not enabled or supported in standard Red Hat Enterprise Linux kernels. Consequently, default Red Hat Enterprise Linux deployments are not exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.