CVE-2023-52907
Description
Wait for out_urb's completion in pn533_usb_send_frame(). Fix a use-after-free that occurs in hcd when in_urb sent from pn533_usb_send_frame() is completed earlier than out_urb. Its callback frees the skb data in pn533_send_async_complete() that is used as a transfer buffer of out_urb. Wait before sending in_urb until the callback of out_urb is called. To modify the callback of out_urb alone, separate the complete function of out_urb and ack_urb.
Statement
A moderate-severity use-after-free vulnerability was found in the Linux kernel NFC pn533 USB driver (drivers/nfc/pn533/usb.c). When pn533_usb_send_frame() sends a frame, the in_urb can complete before the out_urb; the in_urb completion callback pn533_send_async_complete() then frees the skb data that is still being used as the transfer buffer of the outstanding out_urb, resulting in a use-after-free in the USB host controller driver. A local user with access to a system using pn533-based USB NFC hardware could exploit this race condition to cause kernel memory corruption, leading to a crash and denial of service. Red Hat rates this flaw as moderate severity (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access and specific NFC USB hardware, and the primary consequence is loss of availability; this is lower than the upstream CVE.org rating of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), as there is no evidence that this use-after-free provides confidentiality or integrity impact beyond the availability impact. Based on the current assessment, all products in scope for this flaw — Red Hat Enterprise Linux 6, 7, 8, and 9 kernel and kernel-rt streams, the community projects stream, and the hosted OpenShift (ARO and OSD) streams — are marked not affected.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | High |
| Integrity Impact | None | None | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
