CVE-2023-54083

In the Linux kernel, the following vulnerability has been resolved:

phy: tegra: xusb: Clear the driver reference in usb-phy dev

For the dual-role port, it will assign the phy dev to usb-phy dev and use the port dev driver as the dev driver of usb-phy.

When we try to destroy the port dev, it will destroy its dev driver as well. But we did not remove the reference from usb-phy dev. This might cause the use-after-free issue in KASAN.

A use-after-free flaw was found in the NVIDIA Tegra xUSB PHY driver (drivers/phy/tegra/xusb.c) of the Linux kernel. When a dual-role USB port is set up, the port device's driver is reused as the driver of the usb-phy device; when the port device is later destroyed, its driver is freed without clearing the reference still held by the usb-phy device, which can result in a use-after-free, as reported by KASAN. Red Hat assessed this flaw as having low impact: exploitation requires local access on a system using the affected Tegra xUSB dual-role port hardware, and the consequence is limited to system availability (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, score 3.3). The upstream CVE record assigns a higher severity (7.8) using a generic vector that assumes full confidentiality, integrity, and availability impact; Red Hat's lower rating reflects the hardware-specific, availability-only nature of this defect. In Red Hat Enterprise Linux 9, the kernel and kernel-rt streams are marked affected with the fix deferred to a future update, consistent with the low assessed severity of the issue; the residual risk is considered limited because triggering the issue requires local access on affected Tegra xUSB hardware and the impact is restricted to availability. Red Hat Enterprise Linux 6, 7, 8, and 10, and Red Hat In-Vehicle OS 1.0 are not affected because the vulnerable code is not present in those offerings.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.