CVE-2023-33203: Race Condition
In emacprobe, &adpt->workthread is bound with emacworkthread. Then it will be started by timeout handler emactxtimeout or a IRQ handler emacisr. If we remove the driver which will call emacremove to make cleanup, there may be a unfinished work. This could lead to a use-after-free.
Upstream fix: https://github.com/torvalds/linux/commit/6b6bc5b8bd2d
Other sources
Linux Kernel could allow a physical attacker to execute arbitrary code on the system, caused by a race condition in drivers/net/ethernet/qualcomm/emac/emac.c. By unplugging an EMAC-based device, an attacker could exploit this vulnerability to trigger a use-after-free and execute arbitrary code on the system.
— IBM
The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based device.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.3 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 6.2.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 6b6bc5b8bd2d
Event History
Frequently Asked Questions
What is the severity of CVE-2023-33203?
CVE-2023-33203 is classified as a high severity vulnerability due to the potential for a use-after-free condition.
How do I fix CVE-2023-33203?
To fix CVE-2023-33203, update to kernel version 6.3 or later for Red Hat or relevant Debian packages.
Which systems are affected by CVE-2023-33203?
CVE-2023-33203 affects certain versions of the Linux kernel, Red Hat Enterprise Linux 8.0 and 9.0, and IBM Security Verify Governance up to version ISVG 10.0.2.
What could happen if CVE-2023-33203 is exploited?
Exploitation of CVE-2023-33203 could lead to system instability, crashes, or the execution of arbitrary code due to unmanaged memory issues.
Is CVE-2023-33203 a critical vulnerability?
While CVE-2023-33203 is high risk, its criticality depends on the specific environment and exposure of the affected systems.