| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-50212: lib: alloc_tag_module_unload must wait for pending kfree_rcu calls |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| lib: alloc_tag_module_unload must wait for pending kfree_rcu calls |
| |
| Ben Greear reports following splat: |
| ------------[ cut here ]------------ |
| net/netfilter/nf_nat_core.c:1114 module nf_nat func:nf_nat_register_fn has 256 allocated at module unload |
| WARNING: CPU: 1 PID: 10421 at lib/alloc_tag.c:168 alloc_tag_module_unload+0x22b/0x3f0 |
| Modules linked in: nf_nat(-) btrfs ufs qnx4 hfsplus hfs minix vfat msdos fat |
| ... |
| Hardware name: Default string Default string/SKYBAY, BIOS 5.12 08/04/2020 |
| RIP: 0010:alloc_tag_module_unload+0x22b/0x3f0 |
| codetag_unload_module+0x19b/0x2a0 |
| ? codetag_load_module+0x80/0x80 |
| |
| nf_nat module exit calls kfree_rcu on those addresses, but the free |
| operation is likely still pending by the time alloc_tag checks for leaks. |
| |
| Wait for outstanding kfree_rcu operations to complete before checking |
| resolves this warning. |
| |
| Reproducer: |
| unshare -n iptables-nft -t nat -A PREROUTING -p tcp |
| grep nf_nat /proc/allocinfo # will list 4 allocations |
| rmmod nft_chain_nat |
| rmmod nf_nat # will WARN. |
| |
| [akpm@linux-foundation.org: add comment] |
| |
| The Linux kernel CVE team has assigned CVE-2024-50212 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.10 with commit a473573964e51dcb6efc182f773cd3924be4a184 and fixed in 6.11.7 with commit 24211fb49c9ac1b576470b7e393a5a0b50af2707 |
| Issue introduced in 6.10 with commit a473573964e51dcb6efc182f773cd3924be4a184 and fixed in 6.12 with commit dc783ba4b9df3fb3e76e968b2cbeb9960069263c |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-50212 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| lib/codetag.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/24211fb49c9ac1b576470b7e393a5a0b50af2707 |
| https://git.kernel.org/stable/c/dc783ba4b9df3fb3e76e968b2cbeb9960069263c |
