Description
In the Linux kernel, the following vulnerability has been resolved:
aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
This patch is against CVE-2023-6270. The description of cve is:
A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution.
In aoecmd_cfg_pkts(), it always calls dev_put(ifp) when skb initial code is finished. But the net_device ifp will still be used in later tx()->dev_queue_xmit() in kthread. Which means that the dev_put(ifp) should NOT be called in the success path of skb initial code in aoecmd_cfg_pkts(). Otherwise tx() may run into use-after-free because the net_device is freed.
This patch removed the dev_put(ifp) in the success path in aoecmd_cfg_pkts(), and added dev_put() after skb xmit in tx().
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 7562f876cd93800f2f8c89445f2a563590b24e09, < ad80c34944d7175fa1f5c7a55066020002921a99; >= 7562f876cd93800f2f8c89445f2a563590b24e09, < 1a54aa506b3b2f31496731039e49778f54eee881; >= 7562f876cd93800f2f8c89445f2a563590b24e09, < faf0b4c5e00bb680e8e43ac936df24d3f48c8e65; >= 7562f876cd93800f2f8c89445f2a563590b24e09, < 7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4; >= 7562f876cd93800f2f8c89445f2a563590b24e09, < 74ca3ef68d2f449bc848c0a814cefc487bf755fa; >= 7562f876cd93800f2f8c89445f2a563590b24e09, < eb48680b0255a9e8a9bdc93d6a55b11c31262e62; >= 7562f876cd93800f2f8c89445f2a563590b24e09, < 079cba4f4e307c69878226fdf5228c20aa1c969c; >= 7562f876cd93800f2f8c89445f2a563590b24e09, < a16fbb80064634b254520a46395e36b87ca4731e; >= 7562f876cd93800f2f8c89445f2a563590b24e09, < f98364e926626c678fb4b9004b75cacf92ff0662 |
| Linux | Linux | 2.6.22 |
| linux | linux_kernel | 2.6.22 |
| linux | linux_kernel | >= 7562f876cd93, < ad80c34944d7; >= 7562f876cd93, < 1a54aa506b3b; >= 7562f876cd93, < faf0b4c5e00b; >= 7562f876cd93, < 7dd09fa80b07; >= 7562f876cd93, < 74ca3ef68d2f; >= 7562f876cd93, < eb48680b0255; >= 7562f876cd93, < 079cba4f4e30; >= 7562f876cd93, < a16fbb800646; >= 7562f876cd93, < f98364e92662 |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.0, < V3.1.5 |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.0, < V3.1.5 |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | >= V3.1.0, < V3.1.5 |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | >= V3.1.0, < V3.1.5 |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | < V1.1.1 |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.0, < V3.1.5 |
References
- https://git.kernel.org/stable/c/079cba4f4e307c69878226fdf5228c20aa1c969cPatch
- https://git.kernel.org/stable/c/1a54aa506b3b2f31496731039e49778f54eee881Patch
- https://git.kernel.org/stable/c/74ca3ef68d2f449bc848c0a814cefc487bf755faPatch
- https://git.kernel.org/stable/c/7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4Patch
- https://git.kernel.org/stable/c/a16fbb80064634b254520a46395e36b87ca4731ePatch
- https://git.kernel.org/stable/c/ad80c34944d7175fa1f5c7a55066020002921a99Patch
- https://git.kernel.org/stable/c/eb48680b0255a9e8a9bdc93d6a55b11c31262e62Patch
- https://git.kernel.org/stable/c/f98364e926626c678fb4b9004b75cacf92ff0662Patch
- https://git.kernel.org/stable/c/faf0b4c5e00bb680e8e43ac936df24d3f48c8e65Patch
- https://git.kernel.org/stable/c/079cba4f4e307c69878226fdf5228c20aa1c969cPatch
- https://git.kernel.org/stable/c/1a54aa506b3b2f31496731039e49778f54eee881Patch
- https://git.kernel.org/stable/c/74ca3ef68d2f449bc848c0a814cefc487bf755faPatch
- https://git.kernel.org/stable/c/7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4Patch
- https://git.kernel.org/stable/c/a16fbb80064634b254520a46395e36b87ca4731ePatch
- https://git.kernel.org/stable/c/ad80c34944d7175fa1f5c7a55066020002921a99Patch
- https://git.kernel.org/stable/c/eb48680b0255a9e8a9bdc93d6a55b11c31262e62Patch
- https://git.kernel.org/stable/c/f98364e926626c678fb4b9004b75cacf92ff0662Patch
- https://git.kernel.org/stable/c/faf0b4c5e00bb680e8e43ac936df24d3f48c8e65Patch
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Timeline
- Published
- Apr 17, 2024
- Last modified
- Oct 15, 2026
- NVD status
- Modified