| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-42073: mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems |
| |
| The following two shared buffer operations make use of the Shared Buffer |
| Status Register (SBSR): |
| |
| # devlink sb occupancy snapshot pci/0000:01:00.0 |
| # devlink sb occupancy clearmax pci/0000:01:00.0 |
| |
| The register has two masks of 256 bits to denote on which ingress / |
| egress ports the register should operate on. Spectrum-4 has more than |
| 256 ports, so the register was extended by cited commit with a new |
| 'port_page' field. |
| |
| However, when filling the register's payload, the driver specifies the |
| ports as absolute numbers and not relative to the first port of the port |
| page, resulting in memory corruptions [1]. |
| |
| Fix by specifying the ports relative to the first port of the port page. |
| |
| [1] |
| BUG: KASAN: slab-use-after-free in mlxsw_sp_sb_occ_snapshot+0xb6d/0xbc0 |
| Read of size 1 at addr ffff8881068cb00f by task devlink/1566 |
| [...] |
| Call Trace: |
| <TASK> |
| dump_stack_lvl+0xc6/0x120 |
| print_report+0xce/0x670 |
| kasan_report+0xd7/0x110 |
| mlxsw_sp_sb_occ_snapshot+0xb6d/0xbc0 |
| mlxsw_devlink_sb_occ_snapshot+0x75/0xb0 |
| devlink_nl_sb_occ_snapshot_doit+0x1f9/0x2a0 |
| genl_family_rcv_msg_doit+0x20c/0x300 |
| genl_rcv_msg+0x567/0x800 |
| netlink_rcv_skb+0x170/0x450 |
| genl_rcv+0x2d/0x40 |
| netlink_unicast+0x547/0x830 |
| netlink_sendmsg+0x8d4/0xdb0 |
| __sys_sendto+0x49b/0x510 |
| __x64_sys_sendto+0xe5/0x1c0 |
| do_syscall_64+0xc1/0x1d0 |
| entry_SYSCALL_64_after_hwframe+0x77/0x7f |
| [...] |
| Allocated by task 1: |
| kasan_save_stack+0x33/0x60 |
| kasan_save_track+0x14/0x30 |
| __kasan_kmalloc+0x8f/0xa0 |
| copy_verifier_state+0xbc2/0xfb0 |
| do_check_common+0x2c51/0xc7e0 |
| bpf_check+0x5107/0x9960 |
| bpf_prog_load+0xf0e/0x2690 |
| __sys_bpf+0x1a61/0x49d0 |
| __x64_sys_bpf+0x7d/0xc0 |
| do_syscall_64+0xc1/0x1d0 |
| entry_SYSCALL_64_after_hwframe+0x77/0x7f |
| |
| Freed by task 1: |
| kasan_save_stack+0x33/0x60 |
| kasan_save_track+0x14/0x30 |
| kasan_save_free_info+0x3b/0x60 |
| poison_slab_object+0x109/0x170 |
| __kasan_slab_free+0x14/0x30 |
| kfree+0xca/0x2b0 |
| free_verifier_state+0xce/0x270 |
| do_check_common+0x4828/0xc7e0 |
| bpf_check+0x5107/0x9960 |
| bpf_prog_load+0xf0e/0x2690 |
| __sys_bpf+0x1a61/0x49d0 |
| __x64_sys_bpf+0x7d/0xc0 |
| do_syscall_64+0xc1/0x1d0 |
| entry_SYSCALL_64_after_hwframe+0x77/0x7f |
| |
| The Linux kernel CVE team has assigned CVE-2024-42073 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.17 with commit f8538aec88b46642553a9ba9efa0952f5958dbed and fixed in 6.1.97 with commit bfa86a96912faa0b6142a918db88cc0c738a769e |
| Issue introduced in 5.17 with commit f8538aec88b46642553a9ba9efa0952f5958dbed and fixed in 6.6.37 with commit 942901e0fc74ad4b7992ef7ca9336e68d5fd6d36 |
| Issue introduced in 5.17 with commit f8538aec88b46642553a9ba9efa0952f5958dbed and fixed in 6.9.8 with commit bf8781ede7bd9a37c0fcabca78976e61300b5a1a |
| Issue introduced in 5.17 with commit f8538aec88b46642553a9ba9efa0952f5958dbed and fixed in 6.10 with commit c28947de2bed40217cf256c5d0d16880054fcf13 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-42073 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/bfa86a96912faa0b6142a918db88cc0c738a769e |
| https://git.kernel.org/stable/c/942901e0fc74ad4b7992ef7ca9336e68d5fd6d36 |
| https://git.kernel.org/stable/c/bf8781ede7bd9a37c0fcabca78976e61300b5a1a |
| https://git.kernel.org/stable/c/c28947de2bed40217cf256c5d0d16880054fcf13 |
