CVE-2023-53023

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: nfc: Fix use-after-free in local_cleanup()

Fix a use-after-free that occurs in kfree_skb() called from

local_cleanup(). This could happen when killing nfc daemon (e.g. neard)

after detaching an nfc device.

When detaching an nfc device, local_cleanup() called from

nfc_llcp_unregister_device() frees local->rx_pending and decreases

local->ref by kref_put() in nfc_llcp_local_put().

In the terminating process, nfc daemon releases all sockets and it leads

to decreasing local->ref. After the last release of local->ref,

local_cleanup() called from local_release() frees local->rx_pending

again, which leads to the bug.

Setting local->rx_pending to NULL in local_cleanup() could prevent

use-after-free when local_cleanup() is called twice.

Found by a modified version of syzkaller.

BUG: KASAN: use-after-free in kfree_skb()

Call Trace:

dump_stack_lvl (lib/dump_stack.c:106)

print_address_description.constprop.0.cold (mm/kas

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References