| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-50024: net: Fix an unsafe loop on the list |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| net: Fix an unsafe loop on the list |
| |
| The kernel may crash when deleting a genetlink family if there are still |
| listeners for that family: |
| |
| Oops: Kernel access of bad area, sig: 11 [#1] |
| ... |
| NIP [c000000000c080bc] netlink_update_socket_mc+0x3c/0xc0 |
| LR [c000000000c0f764] __netlink_clear_multicast_users+0x74/0xc0 |
| Call Trace: |
| __netlink_clear_multicast_users+0x74/0xc0 |
| genl_unregister_family+0xd4/0x2d0 |
| |
| Change the unsafe loop on the list to a safe one, because inside the |
| loop there is an element removal from this list. |
| |
| The Linux kernel CVE team has assigned CVE-2024-50024 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 2.6.32 with commit b8273570f802a7658827dcb077b0b517ba75a289 and fixed in 4.19.323 with commit 464801a0f6ccb52b21faa33bac6014fd74cc5e10 |
| Issue introduced in 2.6.32 with commit b8273570f802a7658827dcb077b0b517ba75a289 and fixed in 5.4.285 with commit 8e0766fcf37ad8eed289dd3853628dd9b01b58b0 |
| Issue introduced in 2.6.32 with commit b8273570f802a7658827dcb077b0b517ba75a289 and fixed in 5.10.227 with commit 68ad5da6ca630a276f0a5c924179e57724d00013 |
| Issue introduced in 2.6.32 with commit b8273570f802a7658827dcb077b0b517ba75a289 and fixed in 5.15.168 with commit 1cdec792b2450105b1314c5123a9a0452cb2c2f0 |
| Issue introduced in 2.6.32 with commit b8273570f802a7658827dcb077b0b517ba75a289 and fixed in 6.1.113 with commit 5f03a7f601f33cda1f710611625235dc86fd8a9e |
| Issue introduced in 2.6.32 with commit b8273570f802a7658827dcb077b0b517ba75a289 and fixed in 6.6.57 with commit 3be342e0332a7c83eb26fbb22bf156fdca467a5d |
| Issue introduced in 2.6.32 with commit b8273570f802a7658827dcb077b0b517ba75a289 and fixed in 6.11.4 with commit 49f9b726bf2bf3dd2caf0d27cadf4bc1ccf7a7dd |
| Issue introduced in 2.6.32 with commit b8273570f802a7658827dcb077b0b517ba75a289 and fixed in 6.12 with commit 1dae9f1187189bc09ff6d25ca97ead711f7e26f9 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-50024 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| include/net/sock.h |
| net/netlink/af_netlink.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/464801a0f6ccb52b21faa33bac6014fd74cc5e10 |
| https://git.kernel.org/stable/c/8e0766fcf37ad8eed289dd3853628dd9b01b58b0 |
| https://git.kernel.org/stable/c/68ad5da6ca630a276f0a5c924179e57724d00013 |
| https://git.kernel.org/stable/c/1cdec792b2450105b1314c5123a9a0452cb2c2f0 |
| https://git.kernel.org/stable/c/5f03a7f601f33cda1f710611625235dc86fd8a9e |
| https://git.kernel.org/stable/c/3be342e0332a7c83eb26fbb22bf156fdca467a5d |
| https://git.kernel.org/stable/c/49f9b726bf2bf3dd2caf0d27cadf4bc1ccf7a7dd |
| https://git.kernel.org/stable/c/1dae9f1187189bc09ff6d25ca97ead711f7e26f9 |
