CVE-2023-52509 (GCVE-0-2023-52509)

Vulnerability from cvelistv5 – Published: 2024-03-02 21:52 – Updated: 2026-08-05 09:10
VLAI
Title
ravb: Fix use-after-free issue in ravb_tx_timeout_work()
Summary
In the Linux kernel, the following vulnerability has been resolved: ravb: Fix use-after-free issue in ravb_tx_timeout_work() The ravb_stop() should call cancel_work_sync(). Otherwise, ravb_tx_timeout_work() is possible to use the freed priv after ravb_remove() was called like below: CPU0 CPU1 ravb_tx_timeout() ravb_remove() unregister_netdev() free_netdev(ndev) // free priv ravb_tx_timeout_work() // use priv unregister_netdev() will call .ndo_stop() so that ravb_stop() is called. And, after phy_stop() is called, netif_carrier_off() is also called. So that .ndo_tx_timeout() will not be called after phy_stop().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-24 20:38 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c156633f1353264634135dea86ffcae74f2122fc , < 65d34cfd4e347054eb4193bc95d9da7eaa72dee5 (git)
Affected: c156633f1353264634135dea86ffcae74f2122fc , < db9aafa19547833240f58c2998aed7baf414dc82 (git)
Affected: c156633f1353264634135dea86ffcae74f2122fc , < 616761cf9df9af838c0a1a1232a69322a9eb67e6 (git)
Affected: c156633f1353264634135dea86ffcae74f2122fc , < 6f6fa8061f756aedb93af12a8a5d3cf659127965 (git)
Affected: c156633f1353264634135dea86ffcae74f2122fc , < 105abd68ad8f781985113aee2e92e0702b133705 (git)
Affected: c156633f1353264634135dea86ffcae74f2122fc , < 3971442870713de527684398416970cf025b4f89 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.2
Unaffected: 0 , < 4.2 (semver)
Unaffected: 5.4.259 , ≤ 5.4.* (semver)
Unaffected: 5.10.199 , ≤ 5.10.* (semver)
Unaffected: 5.15.136 , ≤ 5.15.* (semver)
Unaffected: 6.1.59 , ≤ 6.1.* (semver)
Unaffected: 6.5.8 , ≤ 6.5.* (semver)
Unaffected: 6.6 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52509",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-24T20:38:43.674426Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-24T20:38:50.426Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:20.848Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/65d34cfd4e347054eb4193bc95d9da7eaa72dee5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/db9aafa19547833240f58c2998aed7baf414dc82"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/616761cf9df9af838c0a1a1232a69322a9eb67e6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6f6fa8061f756aedb93af12a8a5d3cf659127965"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/105abd68ad8f781985113aee2e92e0702b133705"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3971442870713de527684398416970cf025b4f89"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/renesas/ravb_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "65d34cfd4e347054eb4193bc95d9da7eaa72dee5",
              "status": "affected",
              "version": "c156633f1353264634135dea86ffcae74f2122fc",
              "versionType": "git"
            },
            {
              "lessThan": "db9aafa19547833240f58c2998aed7baf414dc82",
              "status": "affected",
              "version": "c156633f1353264634135dea86ffcae74f2122fc",
              "versionType": "git"
            },
            {
              "lessThan": "616761cf9df9af838c0a1a1232a69322a9eb67e6",
              "status": "affected",
              "version": "c156633f1353264634135dea86ffcae74f2122fc",
              "versionType": "git"
            },
            {
              "lessThan": "6f6fa8061f756aedb93af12a8a5d3cf659127965",
              "status": "affected",
              "version": "c156633f1353264634135dea86ffcae74f2122fc",
              "versionType": "git"
            },
            {
              "lessThan": "105abd68ad8f781985113aee2e92e0702b133705",
              "status": "affected",
              "version": "c156633f1353264634135dea86ffcae74f2122fc",
              "versionType": "git"
            },
            {
              "lessThan": "3971442870713de527684398416970cf025b4f89",
              "status": "affected",
              "version": "c156633f1353264634135dea86ffcae74f2122fc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/renesas/ravb_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.259",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.199",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.136",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.59",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.8",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nravb: Fix use-after-free issue in ravb_tx_timeout_work()\n\nThe ravb_stop() should call cancel_work_sync(). Otherwise,\nravb_tx_timeout_work() is possible to use the freed priv after\nravb_remove() was called like below:\n\nCPU0\t\t\tCPU1\n\t\t\travb_tx_timeout()\nravb_remove()\nunregister_netdev()\nfree_netdev(ndev)\n// free priv\n\t\t\travb_tx_timeout_work()\n\t\t\t// use priv\n\nunregister_netdev() will call .ndo_stop() so that ravb_stop() is\ncalled. And, after phy_stop() is called, netif_carrier_off()\nis also called. So that .ndo_tx_timeout() will not be called\nafter phy_stop()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is triggered when local teardown (ravb_close via ip link down, system suspend, or ravb_remove/unbind) races with locally scheduled ravb_tx_timeout_work; remote packets alone cannot free priv or cancel the work.\nAC:L - Once TX-timeout work is queued, the attacker (or routine automotive autosuspend) fully controls when close/remove runs, and ravb_stop_dma inside the worker creates a wide, repeatable window overlapping teardown without relying on an uncontrolled memory layout.\nPR:L - On Renesas R-Car embedded/automotive deployments, ordinary socket traffic arms the timeout path and system autosleep/idle suspend invokes ravb_close without CAP_NET_ADMIN; the same close-vs-work UAF needs no platform unbind/root, matching the CVE-2025-21801 ravb scoring precedent.\nUI:N - Traffic generation and interface/suspend teardown are driven by the attacker or by automatic power-management on the affected platforms; no separate victim user action is required.\nS:U - The use-after-free corrupts host-kernel heap/DMA objects (ravb_private, descriptor rings) within a single kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - ravb_tx_timeout_work continues to dereference priv and ring/skb pointers after free_netdev or ravb_ring_free, so reclaiming those slabs yields an arbitrary kernel-memory read primitive.\nI:H - The same UAF/double-free path re-enters ravb_ring_free/ravb_dmac_init on attacker-reclaimable objects (including work_struct and DMA state), enabling heap corruption and control-flow hijacking.\nA:H - Use-after-free of priv or double-free of DMA rings causes kernel oops/panic and takes down the primary Ethernet interface, as is typical for this race class."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:10:18.221Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/65d34cfd4e347054eb4193bc95d9da7eaa72dee5"
        },
        {
          "url": "https://git.kernel.org/stable/c/db9aafa19547833240f58c2998aed7baf414dc82"
        },
        {
          "url": "https://git.kernel.org/stable/c/616761cf9df9af838c0a1a1232a69322a9eb67e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f6fa8061f756aedb93af12a8a5d3cf659127965"
        },
        {
          "url": "https://git.kernel.org/stable/c/105abd68ad8f781985113aee2e92e0702b133705"
        },
        {
          "url": "https://git.kernel.org/stable/c/3971442870713de527684398416970cf025b4f89"
        }
      ],
      "title": "ravb: Fix use-after-free issue in ravb_tx_timeout_work()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52509",
    "datePublished": "2024-03-02T21:52:22.006Z",
    "dateReserved": "2024-02-20T12:30:33.315Z",
    "dateUpdated": "2026-08-05T09:10:18.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52509",
      "date": "2026-09-24",
      "epss": "0.00244",
      "percentile": "0.13873"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "CEBD0EE2-6EC6-4E58-BB7B-7080FE1E0152",
                  "versionEndExcluding": "5.4.259",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "8D886A8D-A6CD-44FA-ACF5-DD260ECA7A1B",
                  "versionEndExcluding": "5.10.199",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B1FA5161-3AC0-44DF-B1F7-93A070F2B1E7",
                  "versionEndExcluding": "5.15.136",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "96EA633C-1F3E-41C5-A13A-155C55A1F273",
                  "versionEndExcluding": "6.1.59",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "AD4E15B4-2591-4A3A-B2A2-7FEAECD5027D",
                  "versionEndExcluding": "6.5.8",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "84267A4F-DBC2-444F-B41D-69E15E1BEC97",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc2:*:*:*:*:*:*",
                  "matchCriteriaId": "FB440208-241C-4246-9A83-C1715C0DAA6C",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc3:*:*:*:*:*:*",
                  "matchCriteriaId": "0DC421F1-3D5A-4BEF-BF76-4E468985D20B",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc4:*:*:*:*:*:*",
                  "matchCriteriaId": "00AB783B-BE05-40E8-9A55-6AA457D95031",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc5:*:*:*:*:*:*",
                  "matchCriteriaId": "E7C78D0A-C4A2-4D41-B726-8979E33AD0F9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nravb: Fix use-after-free issue in ravb_tx_timeout_work()\n\nThe ravb_stop() should call cancel_work_sync(). Otherwise,\nravb_tx_timeout_work() is possible to use the freed priv after\nravb_remove() was called like below:\n\nCPU0\t\t\tCPU1\n\t\t\travb_tx_timeout()\nravb_remove()\nunregister_netdev()\nfree_netdev(ndev)\n// free priv\n\t\t\travb_tx_timeout_work()\n\t\t\t// use priv\n\nunregister_netdev() will call .ndo_stop() so that ravb_stop() is\ncalled. And, after phy_stop() is called, netif_carrier_off()\nis also called. So that .ndo_tx_timeout() will not be called\nafter phy_stop()."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ravb: soluciona el problema de Use After Free en ravb_tx_timeout_work(). Ravb_stop() deber\u00eda llamar a cancel_work_sync(). De lo contrario, ravb_tx_timeout_work() es posible usar el privilegio liberado despu\u00e9s de que se llam\u00f3 a ravb_remove() como se muestra a continuaci\u00f3n: CPU0 CPU1 ravb_tx_timeout() ravb_remove() unregister_netdev() free_netdev(ndev) // priv libre ravb_tx_timeout_work() // usa priv unregister_netdev() llamar\u00e1 a .ndo_stop() para que se llame a ravb_stop(). Y, despu\u00e9s de llamar a phy_stop(), tambi\u00e9n se llama a netif_carrier_off(). De modo que .ndo_tx_timeout() no ser\u00e1 llamado despu\u00e9s de phy_stop()."
        }
      ],
      "id": "CVE-2023-52509",
      "lastModified": "2024-12-11T15:07:32.760",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-03-02T22:15:47.540",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/105abd68ad8f781985113aee2e92e0702b133705"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/3971442870713de527684398416970cf025b4f89"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/616761cf9df9af838c0a1a1232a69322a9eb67e6"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/65d34cfd4e347054eb4193bc95d9da7eaa72dee5"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/6f6fa8061f756aedb93af12a8a5d3cf659127965"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/db9aafa19547833240f58c2998aed7baf414dc82"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/105abd68ad8f781985113aee2e92e0702b133705"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/3971442870713de527684398416970cf025b4f89"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/616761cf9df9af838c0a1a1232a69322a9eb67e6"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/65d34cfd4e347054eb4193bc95d9da7eaa72dee5"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/6f6fa8061f756aedb93af12a8a5d3cf659127965"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/db9aafa19547833240f58c2998aed7baf414dc82"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-416"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/renesas/ravb_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "65d34cfd4e347054eb4193bc95d9da7eaa72dee5",
                    "status": "affected",
                    "version": "c156633f1353264634135dea86ffcae74f2122fc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "db9aafa19547833240f58c2998aed7baf414dc82",
                    "status": "affected",
                    "version": "c156633f1353264634135dea86ffcae74f2122fc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "616761cf9df9af838c0a1a1232a69322a9eb67e6",
                    "status": "affected",
                    "version": "c156633f1353264634135dea86ffcae74f2122fc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6f6fa8061f756aedb93af12a8a5d3cf659127965",
                    "status": "affected",
                    "version": "c156633f1353264634135dea86ffcae74f2122fc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "105abd68ad8f781985113aee2e92e0702b133705",
                    "status": "affected",
                    "version": "c156633f1353264634135dea86ffcae74f2122fc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3971442870713de527684398416970cf025b4f89",
                    "status": "affected",
                    "version": "c156633f1353264634135dea86ffcae74f2122fc",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/renesas/ravb_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.2"
                  },
                  {
                    "lessThan": "4.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.199",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.136",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.59",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.5.*",
                    "status": "unaffected",
                    "version": "6.5.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.6",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CEBD0EE2-6EC6-4E58-BB7B-7080FE1E0152",
                    "versionEndExcluding": "5.4.259",
                    "versionStartIncluding": "4.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8D886A8D-A6CD-44FA-ACF5-DD260ECA7A1B",
                    "versionEndExcluding": "5.10.199",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B1FA5161-3AC0-44DF-B1F7-93A070F2B1E7",
                    "versionEndExcluding": "5.15.136",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "96EA633C-1F3E-41C5-A13A-155C55A1F273",
                    "versionEndExcluding": "6.1.59",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AD4E15B4-2591-4A3A-B2A2-7FEAECD5027D",
                    "versionEndExcluding": "6.5.8",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "84267A4F-DBC2-444F-B41D-69E15E1BEC97",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "FB440208-241C-4246-9A83-C1715C0DAA6C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "0DC421F1-3D5A-4BEF-BF76-4E468985D20B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "00AB783B-BE05-40E8-9A55-6AA457D95031",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "E7C78D0A-C4A2-4D41-B726-8979E33AD0F9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nravb: Fix use-after-free issue in ravb_tx_timeout_work()\n\nThe ravb_stop() should call cancel_work_sync(). Otherwise,\nravb_tx_timeout_work() is possible to use the freed priv after\nravb_remove() was called like below:\n\nCPU0\t\t\tCPU1\n\t\t\travb_tx_timeout()\nravb_remove()\nunregister_netdev()\nfree_netdev(ndev)\n// free priv\n\t\t\travb_tx_timeout_work()\n\t\t\t// use priv\n\nunregister_netdev() will call .ndo_stop() so that ravb_stop() is\ncalled. And, after phy_stop() is called, netif_carrier_off()\nis also called. So that .ndo_tx_timeout() will not be called\nafter phy_stop()."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ravb: soluciona el problema de Use After Free en ravb_tx_timeout_work(). Ravb_stop() deber\u00eda llamar a cancel_work_sync(). De lo contrario, ravb_tx_timeout_work() es posible usar el privilegio liberado despu\u00e9s de que se llam\u00f3 a ravb_remove() como se muestra a continuaci\u00f3n: CPU0 CPU1 ravb_tx_timeout() ravb_remove() unregister_netdev() free_netdev(ndev) // priv libre ravb_tx_timeout_work() // usa priv unregister_netdev() llamar\u00e1 a .ndo_stop() para que se llame a ravb_stop(). Y, despu\u00e9s de llamar a phy_stop(), tambi\u00e9n se llama a netif_carrier_off(). De modo que .ndo_tx_timeout() no ser\u00e1 llamado despu\u00e9s de phy_stop()."
          }
        ],
        "id": "CVE-2023-52509",
        "lastModified": "2026-08-04T10:18:30.977",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-52509",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-24T20:38:43.674426Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-03-02T22:15:47.540",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/105abd68ad8f781985113aee2e92e0702b133705"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3971442870713de527684398416970cf025b4f89"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/616761cf9df9af838c0a1a1232a69322a9eb67e6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/65d34cfd4e347054eb4193bc95d9da7eaa72dee5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6f6fa8061f756aedb93af12a8a5d3cf659127965"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/db9aafa19547833240f58c2998aed7baf414dc82"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/105abd68ad8f781985113aee2e92e0702b133705"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3971442870713de527684398416970cf025b4f89"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/616761cf9df9af838c0a1a1232a69322a9eb67e6"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/65d34cfd4e347054eb4193bc95d9da7eaa72dee5"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6f6fa8061f756aedb93af12a8a5d3cf659127965"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/db9aafa19547833240f58c2998aed7baf414dc82"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:57:46+00:00",
      "cve": "CVE-2023-52509",
      "id": "CVE-2023-52509",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ravb: Fix use-after-free issue in ravb_tx_timeout_work()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52509.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-02T01:49:16Z",
      "cve": "CVE-2023-52509",
      "id": "CVE-2023-52509",
      "initial_release_date": "2024-03-05T04:31:35Z",
      "product_status:known_not_affected": "216",
      "product_status:recommended": "768",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-52509",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-52509.json",
      "version": "60"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T23:03:20.848Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/65d34cfd4e347054eb4193bc95d9da7eaa72dee5"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/db9aafa19547833240f58c2998aed7baf414dc82"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/616761cf9df9af838c0a1a1232a69322a9eb67e6"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/6f6fa8061f756aedb93af12a8a5d3cf659127965"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/105abd68ad8f781985113aee2e92e0702b133705"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/3971442870713de527684398416970cf025b4f89"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-52509",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-07-24T20:38:43.674426Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-07-24T20:38:48.127Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/renesas/ravb_main.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "65d34cfd4e347054eb4193bc95d9da7eaa72dee5",
                  "status": "affected",
                  "version": "c156633f1353264634135dea86ffcae74f2122fc",
                  "versionType": "git"
                },
                {
                  "lessThan": "db9aafa19547833240f58c2998aed7baf414dc82",
                  "status": "affected",
                  "version": "c156633f1353264634135dea86ffcae74f2122fc",
                  "versionType": "git"
                },
                {
                  "lessThan": "616761cf9df9af838c0a1a1232a69322a9eb67e6",
                  "status": "affected",
                  "version": "c156633f1353264634135dea86ffcae74f2122fc",
                  "versionType": "git"
                },
                {
                  "lessThan": "6f6fa8061f756aedb93af12a8a5d3cf659127965",
                  "status": "affected",
                  "version": "c156633f1353264634135dea86ffcae74f2122fc",
                  "versionType": "git"
                },
                {
                  "lessThan": "105abd68ad8f781985113aee2e92e0702b133705",
                  "status": "affected",
                  "version": "c156633f1353264634135dea86ffcae74f2122fc",
                  "versionType": "git"
                },
                {
                  "lessThan": "3971442870713de527684398416970cf025b4f89",
                  "status": "affected",
                  "version": "c156633f1353264634135dea86ffcae74f2122fc",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/renesas/ravb_main.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.2"
                },
                {
                  "lessThan": "4.2",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.259",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.199",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.136",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.59",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.5.*",
                  "status": "unaffected",
                  "version": "6.5.8",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.6",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.259",
                      "versionStartIncluding": "4.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.199",
                      "versionStartIncluding": "4.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.136",
                      "versionStartIncluding": "4.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.59",
                      "versionStartIncluding": "4.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.5.8",
                      "versionStartIncluding": "4.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6",
                      "versionStartIncluding": "4.2",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nravb: Fix use-after-free issue in ravb_tx_timeout_work()\n\nThe ravb_stop() should call cancel_work_sync(). Otherwise,\nravb_tx_timeout_work() is possible to use the freed priv after\nravb_remove() was called like below:\n\nCPU0\t\t\tCPU1\n\t\t\travb_tx_timeout()\nravb_remove()\nunregister_netdev()\nfree_netdev(ndev)\n// free priv\n\t\t\travb_tx_timeout_work()\n\t\t\t// use priv\n\nunregister_netdev() will call .ndo_stop() so that ravb_stop() is\ncalled. And, after phy_stop() is called, netif_carrier_off()\nis also called. So that .ndo_tx_timeout() will not be called\nafter phy_stop()."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-05-04T07:38:16.664Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/65d34cfd4e347054eb4193bc95d9da7eaa72dee5"
            },
            {
              "url": "https://git.kernel.org/stable/c/db9aafa19547833240f58c2998aed7baf414dc82"
            },
            {
              "url": "https://git.kernel.org/stable/c/616761cf9df9af838c0a1a1232a69322a9eb67e6"
            },
            {
              "url": "https://git.kernel.org/stable/c/6f6fa8061f756aedb93af12a8a5d3cf659127965"
            },
            {
              "url": "https://git.kernel.org/stable/c/105abd68ad8f781985113aee2e92e0702b133705"
            },
            {
              "url": "https://git.kernel.org/stable/c/3971442870713de527684398416970cf025b4f89"
            }
          ],
          "title": "ravb: Fix use-after-free issue in ravb_tx_timeout_work()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2023-52509",
        "datePublished": "2024-03-02T21:52:22.006Z",
        "dateReserved": "2024-02-20T12:30:33.315Z",
        "dateUpdated": "2025-05-04T07:38:16.664Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.