| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2023-53011: net: stmmac: enable all safety features by default |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| net: stmmac: enable all safety features by default |
| |
| In the original implementation of dwmac5 |
| commit 8bf993a5877e ("net: stmmac: Add support for DWMAC5 and implement Safety Features") |
| all safety features were enabled by default. |
| |
| Later it seems some implementations didn't have support for all the |
| features, so in |
| commit 5ac712dcdfef ("net: stmmac: enable platform specific safety features") |
| the safety_feat_cfg structure was added to the callback and defined for |
| some platforms to selectively enable these safety features. |
| |
| The problem is that only certain platforms were given that software |
| support. If the automotive safety package bit is set in the hardware |
| features register the safety feature callback is called for the platform, |
| and for platforms that didn't get a safety_feat_cfg defined this results |
| in the following NULL pointer dereference: |
| |
| [ 7.933303] Call trace: |
| [ 7.935812] dwmac5_safety_feat_config+0x20/0x170 [stmmac] |
| [ 7.941455] __stmmac_open+0x16c/0x474 [stmmac] |
| [ 7.946117] stmmac_open+0x38/0x70 [stmmac] |
| [ 7.950414] __dev_open+0x100/0x1dc |
| [ 7.954006] __dev_change_flags+0x18c/0x204 |
| [ 7.958297] dev_change_flags+0x24/0x6c |
| [ 7.962237] do_setlink+0x2b8/0xfa4 |
| [ 7.965827] __rtnl_newlink+0x4ec/0x840 |
| [ 7.969766] rtnl_newlink+0x50/0x80 |
| [ 7.973353] rtnetlink_rcv_msg+0x12c/0x374 |
| [ 7.977557] netlink_rcv_skb+0x5c/0x130 |
| [ 7.981500] rtnetlink_rcv+0x18/0x2c |
| [ 7.985172] netlink_unicast+0x2e8/0x340 |
| [ 7.989197] netlink_sendmsg+0x1a8/0x420 |
| [ 7.993222] ____sys_sendmsg+0x218/0x280 |
| [ 7.997249] ___sys_sendmsg+0xac/0x100 |
| [ 8.001103] __sys_sendmsg+0x84/0xe0 |
| [ 8.004776] __arm64_sys_sendmsg+0x24/0x30 |
| [ 8.008983] invoke_syscall+0x48/0x114 |
| [ 8.012840] el0_svc_common.constprop.0+0xcc/0xec |
| [ 8.017665] do_el0_svc+0x38/0xb0 |
| [ 8.021071] el0_svc+0x2c/0x84 |
| [ 8.024212] el0t_64_sync_handler+0xf4/0x120 |
| [ 8.028598] el0t_64_sync+0x190/0x194 |
| |
| Go back to the original behavior, if the automotive safety package |
| is found to be supported in hardware enable all the features unless |
| safety_feat_cfg is passed in saying this particular platform only |
| supports a subset of the features. |
| |
| The Linux kernel CVE team has assigned CVE-2023-53011 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.14 with commit 5ac712dcdfefb1a783384db85e0507d161e87812 and fixed in 5.15.91 with commit 120b8e527e07c65de7f2b9018dcd9d17e66f2427 |
| Issue introduced in 5.14 with commit 5ac712dcdfefb1a783384db85e0507d161e87812 and fixed in 6.1.9 with commit aebf7e62708ba706ee7bf484c9023b15c214e92a |
| Issue introduced in 5.14 with commit 5ac712dcdfefb1a783384db85e0507d161e87812 and fixed in 6.2 with commit fdfc76a116b5e9d3e98e6c96fe83b42d011d21d4 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2023-53011 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/net/ethernet/stmicro/stmmac/dwmac5.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/120b8e527e07c65de7f2b9018dcd9d17e66f2427 |
| https://git.kernel.org/stable/c/aebf7e62708ba706ee7bf484c9023b15c214e92a |
| https://git.kernel.org/stable/c/fdfc76a116b5e9d3e98e6c96fe83b42d011d21d4 |
