// For flags

CVE-2023-52846

hsr: Prevent use after free in prp_create_tagged_frame()

Severity Score

7.0
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

In the Linux kernel, the following vulnerability has been resolved: hsr: Prevent use after free in prp_create_tagged_frame() The prp_fill_rct() function can fail. In that situation, it frees the
skb and returns NULL. Meanwhile on the success path, it returns the
original skb. So it's straight forward to fix bug by using the returned
value.

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: hsr: impedir el uso después de liberar en prp_create_tagged_frame(). La función prp_fill_rct() puede fallar. En esa situación, libera el skb y devuelve NULL. Mientras tanto, en el camino hacia el éxito, devuelve el skb original. Por lo tanto, es sencillo corregir el error utilizando el valor devuelto.

In the Linux kernel, the following vulnerability has been resolved: hsr: Prevent use after free in prp_create_tagged_frame() The prp_fill_rct() function can fail. In that situation, it frees the skb and returns NULL. Meanwhile on the success path, it returns the original skb. So it's straight forward to fix bug by using the returned value.

This update for the Linux Kernel 5.14.21-150400_24_111 fixes several issues. The following security issues were fixed. Fixed int overflow for stack access size. Sch_cake: do not call cake_destroy from cake_init. Fixed potential UAF in is_valid_oplock_break. Smb: client: fix use-after-free bug in cifs_debug_data_proc_show. Fixed potential UAF in smb2_is_network_name_deleted. Fixed potential UAF in cifs_stats_proc_show. Fixed potential UAF in smb2_is_valid_lease_break. Intermittent nfs mount failures. Fixed potential UAF in cifs_signal_cifsd_for_reconnect. Gpiolib: cdev: Fix use after free in lineinfo_changed_notify. Net: do not leave a dangling sk pointer, when socket creation fails hfsplus: fix uninit-value in copy_name. Fs/9p: only translate RWX permissions for plain 9P2000. Hsr: Prevent use after free in prp_create_tagged_frame. Fixed a general protection fault in i915_perf_open_ioctl. Set gtt bound flag in amdgpu_ttm_gart_bind. Fixed use-after-free bugs caused by sco_sock_timeout. Drm/client: Fully protect modes with dev->mode_config.mutex. Fixed false-positive lockdep splat for spin_lock in __unix_gc. Fixed double free of the ha->vp_map pointer. Fixed underflow in parse_server_interfaces. Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules. Fixed use-after-free in ip6_route_mpath_notify. Fixed memory corruption in wifi/iwlwifi. Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header. Fixed SDMA off-by-one error in _pad_sdma_tx_descs. Fixed a race condition in nfc_llcp_sock_get and nfc_llcp_sock_get_sn. Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
High
Authentication
Single
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-05-21 CVE Reserved
  • 2024-05-21 CVE Published
  • 2025-05-04 CVE Updated
  • 2025-07-01 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 5.9 < 5.10.201
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.9 < 5.10.201"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 5.9 < 5.15.139
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.9 < 5.15.139"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 5.9 < 6.1.63
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.9 < 6.1.63"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 5.9 < 6.5.12
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.9 < 6.5.12"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 5.9 < 6.6.2
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.9 < 6.6.2"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 5.9 < 6.7
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.9 < 6.7"
en
Affected