Log in Start free

Vulnerability · Published May 21, 2024 · Assigned by Linux

CVE-2023-52846hsr: Prevent use after free in prp_create_tagged_frame()

High 8.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 71.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: hsr: Prevent use after free in prp_create_tagged_frame() The prp_fill_rct() function can fail. In that situation, it frees the skb and returns NULL. Meanwhile on the success path, it returns the original skb. So it's straight forward to fix bug by using the returned value.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.64-1DEBIAN-CVE-2023-52846
Debian:13linux6.6.8-1DEBIAN-CVE-2023-52846
Debian:14linux6.6.8-1DEBIAN-CVE-2023-52846
Ubuntu:22.04:LTSlinux5.15.0-100.110UBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-aws5.15.0-1056.61UBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-azure5.15.0-1058.66UBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1058.66.1UBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-gcp5.15.0-1053.61UBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-gke5.15.0-1052.57UBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1038.44UBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-ibm5.15.0-1048.51UBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1050.56UBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-kvm5.15.0-1052.57UBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-100.110UBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1046.46UBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-nvidia-6.56.5.0-1014.14UBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1025.25UBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1012.12UBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-oracle5.15.0-1053.59UBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-raspi5.15.0-1048.51UBUNTU-CVE-2023-52846
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2023-52846
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1030.34UBUNTU-CVE-2023-52846

Affected products (as reported)

VendorProductVersions
Linux Linux 451d8123f89791bb628277c0bdb4cae34a3563e6 – before ddf4e04e946aaa6c458b8b6829617cc44af2bffd451d8123f89791bb628277c0bdb4cae34a3563e6 – before a1a485e45d24b1cd8fe834fd6f1b06e2903827da451d8123f89791bb628277c0bdb4cae34a3563e6 – before 6086258bd5ea7b5c706ff62da42b8e271b2401db451d8123f89791bb628277c0bdb4cae34a3563e6 – before 1787b9f0729d318d67cf7c5a95f0c3dba9a7cc18451d8123f89791bb628277c0bdb4cae34a3563e6 – before d103fb6726904e353b4773188ee3d3acb4078363451d8123f89791bb628277c0bdb4cae34a3563e6 – before 876f8ab52363f649bcc74072157dfd7adfbabc0d
Linux Linux 5.9

References