CVE-2023-53556

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the iavf driver of the Linux kernel, specifically within the iavf alloc q vectors() function in the drivers/net/ethernet/intel/iavf/iavf main.c module. The problem occurs because netif napi add() is called for all allocated q vectors[], but netif napi del() may only be called for a portion of them. When q vectors is subsequently freed using kfree, invalid pointers remain in the dev->napi list. A local user with administrative privileges can exploit this mismatch in network interface (NAPI) list management to cause a kernel crash, leading to a Denial of Service (DoS), or potentially impact the confidentiality, integrity, and availability of protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.