Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2023-6270

Kernel: aoe: improper reference count leads to use-after-free vulnerability

Description

A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Enterprise Linux 6

Default version status: unknown

Red Hat Red Hat Enterprise Linux 7

Default version status: unknown

Red Hat Red Hat Enterprise Linux 7

Default version status: unknown

Red Hat Red Hat Enterprise Linux 8

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: unaffected

References