CVE-2023-6270CWE-416

Kernel: aoe: improper reference count leads to use-after-free vulnerability

High · published January 4, 2024

CVSS v3.1
7.0
EPSS
0%
Percentile
34.1
In the wild
Unconfirmed
What it is

A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00410 · 34.1th percentile
Weakness
CWE-416 · Use After Free
Published
2024-01-04T17:01Z
EPSS history
Timeline
  • 04 JAN 17:01Z
    Kernel: aoe: improper reference count leads to use-after-free vulnerability
    cvelistv5