CVE-2023-53189

In the Linux kernel, the following vulnerability has been resolved:

ipv6/addrconf: fix a potential refcount underflow for idev

Now in addrconf_mod_rs_timer(), reference idev depends on whether rs_timer is not pending. Then modify rs_timer timeout.

There is a time gap in [1], during which if the pending rs_timer becomes not pending. It will miss to hold idev, but the rs_timer is activated. Thus rs_timer callback function addrconf_rs_timer() will be executed and put idev later without holding idev. A refcount underflow issue for idev can be caused by this.

if (!timer_pending(&idev->rs_timer))
	in6_dev_hold(idev);
	  <--------------[1]
mod_timer(&idev->rs_timer, jiffies + when);

To fix the issue, hold idev if mod_timer() return 0.

A race condition in the IPv6 address configuration code could lead to a refcount underflow in inet6_dev. This might cause a use-after-free and kernel crash, but exploitation beyond denial of service is highly unlikely due to timing constraints. The bug can only be triggered on systems actively using the IPv6 stack.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.