Search: CVE-2023-6270

CVE-2023-6270 is a high-severity use-after-free vulnerability in the ATA over Ethernet (AoE) driver of the Linux kernel used by Red Hat Enterprise Linux 6. The flaw arises from improper reference count handling in the aoecmd_cfg_pkts() function, allowing a race condition between freeing a network device structure and accessing it via a global queue. Exploitation can lead to denial of service or potentially remote code execution. The vulnerability requires local access with low privileges and high attack complexity, with no user interaction needed. Although no known exploits are currently in the wild, affected systems remain at risk until patched. European organizations running RHEL 6, especially in critical infrastructure sectors, should prioritize mitigation. Countries with significant RHEL 6 usage and strategic infrastructure are most at risk. Immediate patching and kernel updates, along with network segmentation and monitoring, are recommended to mitigate impact.