Bug 2221702 (CVE-2023-4133) - CVE-2023-4133 kernel: cxgb4: use-after-free in ch_flower_stats_cb()
Summary: CVE-2023-4133 kernel: cxgb4: use-after-free in ch_flower_stats_cb()
Keywords:
Status: NEW
Alias: CVE-2023-4133
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2221712 2221713 2228787 2228789 2228790
Blocks: 2221670
TreeView+ depends on / blocked
 
Reported: 2023-07-10 15:34 UTC by Mauro Matteo Cascella
Modified: 2024-10-12 08:27 UTC (History)
45 users (show)

Fixed In Version: kernel 6.3
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:2634 0 None None None 2024-05-01 01:21:56 UTC
Red Hat Product Errata RHBA-2024:2650 0 None None None 2024-05-02 00:14:44 UTC
Red Hat Product Errata RHBA-2024:2686 0 None None None 2024-05-02 22:49:53 UTC
Red Hat Product Errata RHSA-2024:2394 0 None None None 2024-04-30 10:11:03 UTC
Red Hat Product Errata RHSA-2024:2950 0 None None None 2024-05-22 09:14:08 UTC
Red Hat Product Errata RHSA-2024:3138 0 None None None 2024-05-22 09:51:00 UTC

Description Mauro Matteo Cascella 2023-07-10 15:34:32 UTC 
From the upstream fix below: The flower_stats_timer can schedule flower_stats_work and flower_stats_work can also arm the flower_stats_timer [..] When the cxgb4 device is detaching, the timer and workqueue could still be rearmed. As a result, a possible use-after-free bug could happen.

Upstream commit:
https://github.com/torvalds/linux/commit/e50b9b9e8610d47b7c22529443e45a16b1ea3a15
Comment 2 Mauro Matteo Cascella 2023-08-03 09:31:06 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2228787]
Comment 4 Justin M. Forbes 2023-08-07 22:09:28 UTC 
This was fixed for Fedora with the 6.2.13 stable kernel updates.
Comment 5 errata-xmlrpc 2024-04-30 10:11:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2394 https://access.redhat.com/errata/RHSA-2024:2394
Comment 6 errata-xmlrpc 2024-05-22 09:14:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:2950 https://access.redhat.com/errata/RHSA-2024:2950
Comment 7 errata-xmlrpc 2024-05-22 09:50:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:3138 https://access.redhat.com/errata/RHSA-2024:3138
Note You need to log in before you can comment on or make changes to this bug.