| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2021-47237: net: hamradio: fix memory leak in mkiss_close |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| net: hamradio: fix memory leak in mkiss_close |
| |
| My local syzbot instance hit memory leak in |
| mkiss_open()[1]. The problem was in missing |
| free_netdev() in mkiss_close(). |
| |
| In mkiss_open() netdevice is allocated and then |
| registered, but in mkiss_close() netdevice was |
| only unregistered, but not freed. |
| |
| Fail log: |
| |
| BUG: memory leak |
| unreferenced object 0xffff8880281ba000 (size 4096): |
| comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) |
| hex dump (first 32 bytes): |
| 61 78 30 00 00 00 00 00 00 00 00 00 00 00 00 00 ax0............. |
| 00 27 fa 2a 80 88 ff ff 00 00 00 00 00 00 00 00 .'.*............ |
| backtrace: |
| [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0 |
| [<ffffffff8706e7e8>] alloc_netdev_mqs+0x98/0xe80 |
| [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1] |
| [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110 |
| [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670 |
| [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440 |
| [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200 |
| [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0 |
| [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae |
| |
| BUG: memory leak |
| unreferenced object 0xffff8880141a9a00 (size 96): |
| comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) |
| hex dump (first 32 bytes): |
| e8 a2 1b 28 80 88 ff ff e8 a2 1b 28 80 88 ff ff ...(.......(.... |
| 98 92 9c aa b0 40 02 00 00 00 00 00 00 00 00 00 .....@.......... |
| backtrace: |
| [<ffffffff8709f68b>] __hw_addr_create_ex+0x5b/0x310 |
| [<ffffffff8709fb38>] __hw_addr_add_ex+0x1f8/0x2b0 |
| [<ffffffff870a0c7b>] dev_addr_init+0x10b/0x1f0 |
| [<ffffffff8706e88b>] alloc_netdev_mqs+0x13b/0xe80 |
| [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1] |
| [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110 |
| [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670 |
| [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440 |
| [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200 |
| [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0 |
| [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae |
| |
| BUG: memory leak |
| unreferenced object 0xffff8880219bfc00 (size 512): |
| comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) |
| hex dump (first 32 bytes): |
| 00 a0 1b 28 80 88 ff ff 80 8f b1 8d ff ff ff ff ...(............ |
| 80 8f b1 8d ff ff ff ff 00 00 00 00 00 00 00 00 ................ |
| backtrace: |
| [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0 |
| [<ffffffff8706eec7>] alloc_netdev_mqs+0x777/0xe80 |
| [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1] |
| [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110 |
| [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670 |
| [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440 |
| [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200 |
| [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0 |
| [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae |
| |
| BUG: memory leak |
| unreferenced object 0xffff888029b2b200 (size 256): |
| comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) |
| hex dump (first 32 bytes): |
| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ |
| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ |
| backtrace: |
| [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0 |
| [<ffffffff8706f062>] alloc_netdev_mqs+0x912/0xe80 |
| [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1] |
| [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110 |
| [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670 |
| [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440 |
| [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200 |
| [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0 |
| [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae |
| |
| The Linux kernel CVE team has assigned CVE-2021-47237 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 2.6.14 with commit 815f62bf742718458ba822a7e1f51f285eb997f2 and fixed in 4.4.274 with commit c634ba0b4159838ff45a60d3a0ace3b4118077a5 |
| Issue introduced in 2.6.14 with commit 815f62bf742718458ba822a7e1f51f285eb997f2 and fixed in 4.9.274 with commit 3942d0f9ace1a95a74930b5b4fc0e5005c62b37b |
| Issue introduced in 2.6.14 with commit 815f62bf742718458ba822a7e1f51f285eb997f2 and fixed in 4.14.238 with commit 765a8a04f828db7222b36a42b1031f576bfe95c3 |
| Issue introduced in 2.6.14 with commit 815f62bf742718458ba822a7e1f51f285eb997f2 and fixed in 4.19.196 with commit c16c4716a1b5ba4f83c7e00da457cba06761f119 |
| Issue introduced in 2.6.14 with commit 815f62bf742718458ba822a7e1f51f285eb997f2 and fixed in 5.4.128 with commit a49cbb762ef20655f5c91abdc13658b0af5e159d |
| Issue introduced in 2.6.14 with commit 815f62bf742718458ba822a7e1f51f285eb997f2 and fixed in 5.10.46 with commit 290b0b6432e2599021db0b8d6046f756d931c29f |
| Issue introduced in 2.6.14 with commit 815f62bf742718458ba822a7e1f51f285eb997f2 and fixed in 5.12.13 with commit f4de2b43d13b7cf3ced9310e371b90c836dbd7cd |
| Issue introduced in 2.6.14 with commit 815f62bf742718458ba822a7e1f51f285eb997f2 and fixed in 5.13 with commit 7edcc682301492380fbdd604b4516af5ae667a13 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2021-47237 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/net/hamradio/mkiss.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/c634ba0b4159838ff45a60d3a0ace3b4118077a5 |
| https://git.kernel.org/stable/c/3942d0f9ace1a95a74930b5b4fc0e5005c62b37b |
| https://git.kernel.org/stable/c/765a8a04f828db7222b36a42b1031f576bfe95c3 |
| https://git.kernel.org/stable/c/c16c4716a1b5ba4f83c7e00da457cba06761f119 |
| https://git.kernel.org/stable/c/a49cbb762ef20655f5c91abdc13658b0af5e159d |
| https://git.kernel.org/stable/c/290b0b6432e2599021db0b8d6046f756d931c29f |
| https://git.kernel.org/stable/c/f4de2b43d13b7cf3ced9310e371b90c836dbd7cd |
| https://git.kernel.org/stable/c/7edcc682301492380fbdd604b4516af5ae667a13 |
