| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-27013: tun: limit printing rate when illegal packet received by tun dev |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| tun: limit printing rate when illegal packet received by tun dev |
| |
| vhost_worker will call tun call backs to receive packets. If too many |
| illegal packets arrives, tun_do_read will keep dumping packet contents. |
| When console is enabled, it will costs much more cpu time to dump |
| packet and soft lockup will be detected. |
| |
| net_ratelimit mechanism can be used to limit the dumping rate. |
| |
| PID: 33036 TASK: ffff949da6f20000 CPU: 23 COMMAND: "vhost-32980" |
| #0 [fffffe00003fce50] crash_nmi_callback at ffffffff89249253 |
| #1 [fffffe00003fce58] nmi_handle at ffffffff89225fa3 |
| #2 [fffffe00003fceb0] default_do_nmi at ffffffff8922642e |
| #3 [fffffe00003fced0] do_nmi at ffffffff8922660d |
| #4 [fffffe00003fcef0] end_repeat_nmi at ffffffff89c01663 |
| [exception RIP: io_serial_in+20] |
| RIP: ffffffff89792594 RSP: ffffa655314979e8 RFLAGS: 00000002 |
| RAX: ffffffff89792500 RBX: ffffffff8af428a0 RCX: 0000000000000000 |
| RDX: 00000000000003fd RSI: 0000000000000005 RDI: ffffffff8af428a0 |
| RBP: 0000000000002710 R8: 0000000000000004 R9: 000000000000000f |
| R10: 0000000000000000 R11: ffffffff8acbf64f R12: 0000000000000020 |
| R13: ffffffff8acbf698 R14: 0000000000000058 R15: 0000000000000000 |
| ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 |
| #5 [ffffa655314979e8] io_serial_in at ffffffff89792594 |
| #6 [ffffa655314979e8] wait_for_xmitr at ffffffff89793470 |
| #7 [ffffa65531497a08] serial8250_console_putchar at ffffffff897934f6 |
| #8 [ffffa65531497a20] uart_console_write at ffffffff8978b605 |
| #9 [ffffa65531497a48] serial8250_console_write at ffffffff89796558 |
| #10 [ffffa65531497ac8] console_unlock at ffffffff89316124 |
| #11 [ffffa65531497b10] vprintk_emit at ffffffff89317c07 |
| #12 [ffffa65531497b68] printk at ffffffff89318306 |
| #13 [ffffa65531497bc8] print_hex_dump at ffffffff89650765 |
| #14 [ffffa65531497ca8] tun_do_read at ffffffffc0b06c27 [tun] |
| #15 [ffffa65531497d38] tun_recvmsg at ffffffffc0b06e34 [tun] |
| #16 [ffffa65531497d68] handle_rx at ffffffffc0c5d682 [vhost_net] |
| #17 [ffffa65531497ed0] vhost_worker at ffffffffc0c644dc [vhost] |
| #18 [ffffa65531497f10] kthread at ffffffff892d2e72 |
| #19 [ffffa65531497f50] ret_from_fork at ffffffff89c0022f |
| |
| The Linux kernel CVE team has assigned CVE-2024-27013 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 2.6.35 with commit ef3db4a5954281bc1ea49a4739c88eaea091dc71 and fixed in 4.19.313 with commit 68459b8e3ee554ce71878af9eb69659b9462c588 |
| Issue introduced in 2.6.35 with commit ef3db4a5954281bc1ea49a4739c88eaea091dc71 and fixed in 5.4.275 with commit 4b0dcae5c4797bf31c63011ed62917210d3fdac3 |
| Issue introduced in 2.6.35 with commit ef3db4a5954281bc1ea49a4739c88eaea091dc71 and fixed in 5.10.216 with commit 14cdb43dbc827e18ac7d5b30c5b4c676219f1421 |
| Issue introduced in 2.6.35 with commit ef3db4a5954281bc1ea49a4739c88eaea091dc71 and fixed in 5.15.157 with commit a50dbeca28acf7051dfa92786b85f704c75db6eb |
| Issue introduced in 2.6.35 with commit ef3db4a5954281bc1ea49a4739c88eaea091dc71 and fixed in 6.1.88 with commit 62e27ef18eb4f0d33bbae8e9ef56b99696a74713 |
| Issue introduced in 2.6.35 with commit ef3db4a5954281bc1ea49a4739c88eaea091dc71 and fixed in 6.6.29 with commit 40f4ced305c6c47487d3cd8da54676e2acc1a6ad |
| Issue introduced in 2.6.35 with commit ef3db4a5954281bc1ea49a4739c88eaea091dc71 and fixed in 6.8.8 with commit 52854101180beccdb9dc2077a3bea31b6ad48dfa |
| Issue introduced in 2.6.35 with commit ef3db4a5954281bc1ea49a4739c88eaea091dc71 and fixed in 6.9 with commit f8bbc07ac535593139c875ffa19af924b1084540 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-27013 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/net/tun.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/68459b8e3ee554ce71878af9eb69659b9462c588 |
| https://git.kernel.org/stable/c/4b0dcae5c4797bf31c63011ed62917210d3fdac3 |
| https://git.kernel.org/stable/c/14cdb43dbc827e18ac7d5b30c5b4c676219f1421 |
| https://git.kernel.org/stable/c/a50dbeca28acf7051dfa92786b85f704c75db6eb |
| https://git.kernel.org/stable/c/62e27ef18eb4f0d33bbae8e9ef56b99696a74713 |
| https://git.kernel.org/stable/c/40f4ced305c6c47487d3cd8da54676e2acc1a6ad |
| https://git.kernel.org/stable/c/52854101180beccdb9dc2077a3bea31b6ad48dfa |
| https://git.kernel.org/stable/c/f8bbc07ac535593139c875ffa19af924b1084540 |
