| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-47688: driver core: Fix a potential null-ptr-deref in module_add_driver() |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| driver core: Fix a potential null-ptr-deref in module_add_driver() |
| |
| Inject fault while probing of-fpga-region, if kasprintf() fails in |
| module_add_driver(), the second sysfs_remove_link() in exit path will cause |
| null-ptr-deref as below because kernfs_name_hash() will call strlen() with |
| NULL driver_name. |
| |
| Fix it by releasing resources based on the exit path sequence. |
| |
| KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] |
| Mem abort info: |
| ESR = 0x0000000096000005 |
| EC = 0x25: DABT (current EL), IL = 32 bits |
| SET = 0, FnV = 0 |
| EA = 0, S1PTW = 0 |
| FSC = 0x05: level 1 translation fault |
| Data abort info: |
| ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 |
| CM = 0, WnR = 0, TnD = 0, TagAccess = 0 |
| GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 |
| [dfffffc000000000] address between user and kernel address ranges |
| Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP |
| Dumping ftrace buffer: |
| (ftrace buffer empty) |
| Modules linked in: of_fpga_region(+) fpga_region fpga_bridge cfg80211 rfkill 8021q garp mrp stp llc ipv6 [last unloaded: of_fpga_region] |
| CPU: 2 UID: 0 PID: 2036 Comm: modprobe Not tainted 6.11.0-rc2-g6a0e38264012 #295 |
| Hardware name: linux,dummy-virt (DT) |
| pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) |
| pc : strlen+0x24/0xb0 |
| lr : kernfs_name_hash+0x1c/0xc4 |
| sp : ffffffc081f97380 |
| x29: ffffffc081f97380 x28: ffffffc081f97b90 x27: ffffff80c821c2a0 |
| x26: ffffffedac0be418 x25: 0000000000000000 x24: ffffff80c09d2000 |
| x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 |
| x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000001840 |
| x17: 0000000000000000 x16: 0000000000000000 x15: 1ffffff8103f2e42 |
| x14: 00000000f1f1f1f1 x13: 0000000000000004 x12: ffffffb01812d61d |
| x11: 1ffffff01812d61c x10: ffffffb01812d61c x9 : dfffffc000000000 |
| x8 : 0000004fe7ed29e4 x7 : ffffff80c096b0e7 x6 : 0000000000000001 |
| x5 : ffffff80c096b0e0 x4 : 1ffffffdb990efa2 x3 : 0000000000000000 |
| x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000000 |
| Call trace: |
| strlen+0x24/0xb0 |
| kernfs_name_hash+0x1c/0xc4 |
| kernfs_find_ns+0x118/0x2e8 |
| kernfs_remove_by_name_ns+0x80/0x100 |
| sysfs_remove_link+0x74/0xa8 |
| module_add_driver+0x278/0x394 |
| bus_add_driver+0x1f0/0x43c |
| driver_register+0xf4/0x3c0 |
| __platform_driver_register+0x60/0x88 |
| of_fpga_region_init+0x20/0x1000 [of_fpga_region] |
| do_one_initcall+0x110/0x788 |
| do_init_module+0x1dc/0x5c8 |
| load_module+0x3c38/0x4cac |
| init_module_from_file+0xd4/0x128 |
| idempotent_init_module+0x2cc/0x528 |
| __arm64_sys_finit_module+0xac/0x100 |
| invoke_syscall+0x6c/0x258 |
| el0_svc_common.constprop.0+0x160/0x22c |
| do_el0_svc+0x44/0x5c |
| el0_svc+0x48/0xb8 |
| el0t_64_sync_handler+0x13c/0x158 |
| el0t_64_sync+0x190/0x194 |
| Code: f2fbffe1 a90157f4 12000802 aa0003f5 (38e16861) |
| ---[ end trace 0000000000000000 ]--- |
| Kernel panic - not syncing: Oops: Fatal exception |
| |
| The Linux kernel CVE team has assigned CVE-2024-47688 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.6.33 with commit 28f5a08600d0ea6831629d450193c4045094e729 and fixed in 6.6.54 with commit b8e45b910525704010d10c9dcbf2abf3005aa97c |
| Issue introduced in 6.10 with commit 85d2b0aa170351380be39fe4ff7973df1427fe76 and fixed in 6.10.13 with commit 4b5d48b7a29cc6d508121a4b4e0c97a891e5273c |
| Issue introduced in 6.10 with commit 85d2b0aa170351380be39fe4ff7973df1427fe76 and fixed in 6.11.2 with commit dcb9d581dee4c23f2378b6650511ece80dda4e2f |
| Issue introduced in 6.10 with commit 85d2b0aa170351380be39fe4ff7973df1427fe76 and fixed in 6.12 with commit 18ec12c97b39ff6aa15beb8d2b25d15cd44b87d8 |
| Issue introduced in 6.9.4 with commit 51dacb1b0467b616463a334cbcd048f5710ba2aa |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-47688 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/base/module.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/b8e45b910525704010d10c9dcbf2abf3005aa97c |
| https://git.kernel.org/stable/c/4b5d48b7a29cc6d508121a4b4e0c97a891e5273c |
| https://git.kernel.org/stable/c/dcb9d581dee4c23f2378b6650511ece80dda4e2f |
| https://git.kernel.org/stable/c/18ec12c97b39ff6aa15beb8d2b25d15cd44b87d8 |
