Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2024-26898

aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, and 3 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts This patch is against CVE-2023-6270. The description of cve is: A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution. In aoecmd_cfg_pkts(), it always calls dev_put(ifp) when skb initial code is finished. But the net_device ifp will still be used in later tx()->dev_queue_xmit() in kthread. Which means that the dev_put(ifp) should NOT be called in the success path of skb initial code in aoecmd_cfg_pkts(). Otherwise tx() may run into use-after-free because the net_device is freed. This patch removed the dev_put(ifp) in the success path in aoecmd_cfg_pkts(), and added dev_put() after skb xmit in tx().

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 7562f876cd93800f2f8c89445f2a563590b24e09 · fixed in ad80c34944d7175fa1f5c7a55066020002921a99; From 7562f876cd93800f2f8c89445f2a563590b24e09 · fixed in 1a54aa506b3b2f31496731039e49778f54eee881; From 7562f876cd93800f2f8c89445f2a563590b24e09 · fixed in faf0b4c5e00bb680e8e43ac936df24d3f48c8e65; From 7562f876cd93800f2f8c89445f2a563590b24e09 · fixed in 7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4; From 7562f876cd93800f2f8c89445f2a563590b24e09 · fixed in 74ca3ef68d2f449bc848c0a814cefc487bf755fa; From 7562f876cd93800f2f8c89445f2a563590b24e09 · fixed in eb48680b0255a9e8a9bdc93d6a55b11c31262e62; From 7562f876cd93800f2f8c89445f2a563590b24e09 · fixed in 079cba4f4e307c69878226fdf5228c20aa1c969c; From 7562f876cd93800f2f8c89445f2a563590b24e09 · fixed in a16fbb80064634b254520a46395e36b87ca4731e; From 7562f876cd93800f2f8c89445f2a563590b24e09 · fixed in f98364e926626c678fb4b9004b75cacf92ff0662

  • Linux Linux

    2.6.22

  • KernelLinux

    From 2.6.22 · fixed in 4.19.311; From 4.20.0 · fixed in 5.4.273; From 5.5.0 · fixed in 5.10.214; From 5.11.0 · fixed in 5.15.153; From 5.16.0 · fixed in 6.1.83; From 6.2.0 · fixed in 6.6.23; From 6.7.0 · fixed in 6.7.11; From 6.8.0 · fixed in 6.8.2

References 9

git.kernel.org