ravb: Fix use-after-free issue in ravb_tx_timeout_work() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.24 % · percentile 16 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: ravb: Fix use-after-free issue in ravb_tx_timeout_work() The ravb_stop() should call cancel_work_sync(). Otherwise, ravb_tx_timeout_work() is possible to use the freed priv after ravb_remove() was called like below: CPU0 CPU1 ravb_tx_timeout() ravb_remove() unregister_netdev() free_netdev(ndev) // free priv ravb_tx_timeout_work() // use priv unregister_netdev() will call .ndo_stop() so that ravb_stop() is called. And, after phy_stop() is called, netif_carrier_off() is also called. So that .ndo_tx_timeout() will not be called after phy_stop().
Weaknesses (CWE)
- CWE-416 — Use After Free
References
- https://git.kernel.org/stable/c/65d34cfd4e347054eb4193bc95d9da7eaa72dee5
- https://git.kernel.org/stable/c/db9aafa19547833240f58c2998aed7baf414dc82
- https://git.kernel.org/stable/c/616761cf9df9af838c0a1a1232a69322a9eb67e6
- https://git.kernel.org/stable/c/6f6fa8061f756aedb93af12a8a5d3cf659127965
- https://git.kernel.org/stable/c/105abd68ad8f781985113aee2e92e0702b133705
- https://git.kernel.org/stable/c/3971442870713de527684398416970cf025b4f89
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2023-57134
- GCVE · GCVE-0-2023-52509
CERT-FR advisories
- CERTFR-2025-AVI-0677 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0022 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0458 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0440 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0420 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0363 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0329 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.2 < 5.4.259cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.199cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.136cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.59cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.5.8cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.6:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.6:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.6:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.6:rc5:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected c156633f1353264634135dea86ffcae74f2122fc < 65d34cfd4e347054eb4193bc95d9da7eaa72dee5 ; affected c156633f1353264634135dea86ffcae74f2122fc < db9aafa19547833240f58c2998aed7baf414dc82 ; affected c156633f1353264634135dea86ffcae74f2122fc < 616761cf9df9af838c0a1a1232a69322a9eb67e6 ; affected c156633f1353264634135dea86ffcae74f2122fc < 6f6fa8061f756aedb93af12a8a5d3cf659127965 ; affected c156633f1353264634135dea86ffcae74f2122fc < 105abd68ad8f781985113aee2e92e0702b133705 ; affected c156633f1353264634135dea86ffcae74f2122fc < 3971442870713de527684398416970cf025b4f89 |
| Linux · Linux | affected 4.2 ; unaffected 0 < 4.2 ; unaffected 5.4.259 ≤ 5.4.* ; unaffected 5.10.199 ≤ 5.10.* ; unaffected 5.15.136 ≤ 5.15.* ; unaffected 6.1.59 ≤ 6.1.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |