CVE-2023-52846

What it actually does

Use-after-free in Linux kernel HSR/PRP code path when prp_fill_rct() fails, frees the skb, returns NULL, but caller continues using the original skb pointer.

Why it matters to the business

Kernel memory corruption on Linux systems using HSR/PRP network redundancy can cause crashes, denial of service, or potential code execution; high prevalence in industrial and embedded Linux deployments increases exposure.

How an attack unfolds

An attacker sends crafted network frames that trigger failure in prp_fill_rct() during tagged frame creation; the freed skb is then accessed, leading to use-after-free that may be leveraged for memory corruption or privilege escalation.

How to fix it

Upgrade Linux kernel to commit ddf4e04e946aaa6c458b8b6829617cc44af2bffd or later stable release containing the fix; apply vendor kernel updates that incorporate this commit.

How to confirm the fix worked

Verify kernel source contains commit ddf4e04e946aaa6c458b8b6829617cc44af2bffd; confirm prp_create_tagged_frame() now uses the return value of prp_fill_rct() before any further skb operations.

Typical attack path

1. Identify Linux kernel with HSR/PRP enabled
2. Craft and transmit frames that cause prp_fill_rct() to fail and free skb
3. Trigger continued use of the dangling skb pointer
4. Exploit resulting memory corruption for code execution or crash

How to detect it

Review kernel logs for skb-related oops or use-after-free warnings in hsr/prp code paths; correlate with network traffic triggering prp_create_tagged_frame(); examine crash dumps for dangling skb references.

What your security team should do

• Prioritize kernel upgrades on systems with HSR/PRP networking enabled
• Monitor for vendor backports of ddf4e04e946aaa6c458b8b6829617cc44af2bffd
• Restrict HSR/PRP interfaces to trusted networks until patched