| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-38586: r8169: Fix possible ring buffer corruption on fragmented Tx packets. |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| r8169: Fix possible ring buffer corruption on fragmented Tx packets. |
| |
| An issue was found on the RTL8125b when transmitting small fragmented |
| packets, whereby invalid entries were inserted into the transmit ring |
| buffer, subsequently leading to calls to dma_unmap_single() with a null |
| address. |
| |
| This was caused by rtl8169_start_xmit() not noticing changes to nr_frags |
| which may occur when small packets are padded (to work around hardware |
| quirks) in rtl8169_tso_csum_v2(). |
| |
| To fix this, postpone inspecting nr_frags until after any padding has been |
| applied. |
| |
| The Linux kernel CVE team has assigned CVE-2024-38586 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.7 with commit 9020845fb5d6bb4876a38fdf1259600e7d9a63d4 and fixed in 5.10.221 with commit 61c1c98e2607120ce9c3fa1bf75e6da909712b27 |
| Issue introduced in 5.7 with commit 9020845fb5d6bb4876a38fdf1259600e7d9a63d4 and fixed in 5.15.161 with commit b6d21cf40de103d63ae78551098a7c06af8c98dd |
| Issue introduced in 5.7 with commit 9020845fb5d6bb4876a38fdf1259600e7d9a63d4 and fixed in 6.1.93 with commit 0c48185a95309556725f818b82120bb74e9c627d |
| Issue introduced in 5.7 with commit 9020845fb5d6bb4876a38fdf1259600e7d9a63d4 and fixed in 6.6.33 with commit 68222d7b4b72aa321135cd453dac37f00ec41fd1 |
| Issue introduced in 5.7 with commit 9020845fb5d6bb4876a38fdf1259600e7d9a63d4 and fixed in 6.8.12 with commit 078d5b7500d70af2de6b38e226b03f0b932026a6 |
| Issue introduced in 5.7 with commit 9020845fb5d6bb4876a38fdf1259600e7d9a63d4 and fixed in 6.9.3 with commit 54e7a0d111240c92c0f02ceba6eb8f26bf6d6479 |
| Issue introduced in 5.7 with commit 9020845fb5d6bb4876a38fdf1259600e7d9a63d4 and fixed in 6.10 with commit c71e3a5cffd5309d7f84444df03d5b72600cc417 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-38586 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/net/ethernet/realtek/r8169_main.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/61c1c98e2607120ce9c3fa1bf75e6da909712b27 |
| https://git.kernel.org/stable/c/b6d21cf40de103d63ae78551098a7c06af8c98dd |
| https://git.kernel.org/stable/c/0c48185a95309556725f818b82120bb74e9c627d |
| https://git.kernel.org/stable/c/68222d7b4b72aa321135cd453dac37f00ec41fd1 |
| https://git.kernel.org/stable/c/078d5b7500d70af2de6b38e226b03f0b932026a6 |
| https://git.kernel.org/stable/c/54e7a0d111240c92c0f02ceba6eb8f26bf6d6479 |
| https://git.kernel.org/stable/c/c71e3a5cffd5309d7f84444df03d5b72600cc417 |
