Bug 2192667 (CVE-2023-33203)

Summary:	CVE-2023-33203 kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove()
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, allarkin, bhu, chwhite, dbohanno, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, hackerzheng666, hkrzesin, jarod, jburrell, jdenham, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, ldoskova, lgoncalv, lleshchi, lzampier, nmurray, ptalbert, qzhao, rogbas, rrobaina, rvrbovsk, rysulliv, scweaver, swood, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.3-rc4	Doc Type:	If docs needed, set a value
Doc Text:	A race condition vulnerability was found in the Linux kernel's Qualcomm EMAC Gigabit Ethernet Controller when the user physically removes the device before cleanup in the emac_remove function. This flaw can eventually result in a use-after-free issue, possibly leading to a system crash or other undefined behaviors.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2192672, 2192673, 2192674, 2192675, 2192669
Bug Blocks:	2186214

Description Mauro Matteo Cascella 2023-05-02 17:04:35 UTC

In emac_probe, &adpt->work_thread is bound with emac_work_thread. Then it will be started by timeout handler emac_tx_timeout or a IRQ handler emac_isr. If we remove the driver which will call emac_remove to make cleanup, there may be a unfinished work. This could lead to a use-after-free.

Upstream fix:
https://github.com/torvalds/linux/commit/6b6bc5b8bd2d

Comment 1 Mauro Matteo Cascella 2023-05-02 17:05:05 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2192669]

Comment 4 Justin M. Forbes 2023-05-02 21:08:48 UTC

This was fixed for Fedora with the 6.2.9 stable kernel updates.

Comment 5 hackerzheng666 2023-05-03 15:02:00 UTC

Here is the credit Information:

Zheng Wang(@xmzyshypnc), Zhuorao Yang(@A1ex), Yang Hu(@BlueSheep) and
Zong Cao(@P1umer)

Comment 6 Mauro Matteo Cascella 2023-06-19 15:03:42 UTC

CVE-2023-2483 was rejected as duplicate of CVE-2023-33203. See https://nvd.nist.gov/vuln/detail/CVE-2023-2483 for more details. Updating bug summary accordingly.