SB2024050835 - Privilege escalation in Linux kernel Renesas Ethernet AVB driver
Published: May 8, 2024 Updated: May 14, 2025
Security Bulletin ID
SB2024050835
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Use-after-free (CVE-ID: CVE-2023-52509)
The vulnerability allows a local user can escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the ravb_close() function in drivers/net/ethernet/renesas/ravb_main.c. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/65d34cfd4e347054eb4193bc95d9da7eaa72dee5
- https://git.kernel.org/stable/c/db9aafa19547833240f58c2998aed7baf414dc82
- https://git.kernel.org/stable/c/616761cf9df9af838c0a1a1232a69322a9eb67e6
- https://git.kernel.org/stable/c/6f6fa8061f756aedb93af12a8a5d3cf659127965
- https://git.kernel.org/stable/c/105abd68ad8f781985113aee2e92e0702b133705
- https://git.kernel.org/stable/c/3971442870713de527684398416970cf025b4f89
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.199
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.136
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.259
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.59
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.8
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6