CVE-2023-53219

In the Linux kernel, the following vulnerability has been resolved:

media: netup_unidvb: fix use-after-free at del_timer()

When Universal DVB card is detaching, netup_unidvb_dma_fini() uses del_timer() to stop dma->timeout timer. But when timer handler netup_unidvb_dma_timeout() is running, del_timer() could not stop it. As a result, the use-after-free bug could happen. The process is shown below:

(cleanup routine)          |        (timer routine)
                           | mod_timer(&dev->tx_sim_timer, ..)

netup_unidvb_finidev() | (wait a time) netup_unidvb_dma_fini() | netup_unidvb_dma_timeout() del_timer(&dma->timeout); | | ndev->pci_dev->dev //USE

Fix by changing del_timer() to del_timer_sync().

Red Hat Enterprise Linux is not vulnerable to this issue because the NetUP Universal DVB driver is not enabled or built in supported kernels. Triggering this flaw requires local or administrative access to attach and disconnect specific NetUP DVB hardware while DMA transactions are in flight. As a result, this flaw presents no risk to Red Hat deployments.