| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-50298: net: enetc: allocate vf_state during PF probes |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| net: enetc: allocate vf_state during PF probes |
| |
| In the previous implementation, vf_state is allocated memory only when VF |
| is enabled. However, net_device_ops::ndo_set_vf_mac() may be called before |
| VF is enabled to configure the MAC address of VF. If this is the case, |
| enetc_pf_set_vf_mac() will access vf_state, resulting in access to a null |
| pointer. The simplified error log is as follows. |
| |
| root@ls1028ardb:~# ip link set eno0 vf 1 mac 00:0c:e7:66:77:89 |
| [ 173.543315] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 |
| [ 173.637254] pc : enetc_pf_set_vf_mac+0x3c/0x80 Message from sy |
| [ 173.641973] lr : do_setlink+0x4a8/0xec8 |
| [ 173.732292] Call trace: |
| [ 173.734740] enetc_pf_set_vf_mac+0x3c/0x80 |
| [ 173.738847] __rtnl_newlink+0x530/0x89c |
| [ 173.742692] rtnl_newlink+0x50/0x7c |
| [ 173.746189] rtnetlink_rcv_msg+0x128/0x390 |
| [ 173.750298] netlink_rcv_skb+0x60/0x130 |
| [ 173.754145] rtnetlink_rcv+0x18/0x24 |
| [ 173.757731] netlink_unicast+0x318/0x380 |
| [ 173.761665] netlink_sendmsg+0x17c/0x3c8 |
| |
| The Linux kernel CVE team has assigned CVE-2024-50298 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.1 with commit d4fd0404c1c95b17880f254ebfee3485693fa8ba and fixed in 6.6.61 with commit ef0edfbe9eeed1fccad7cb705648af5222664944 |
| Issue introduced in 5.1 with commit d4fd0404c1c95b17880f254ebfee3485693fa8ba and fixed in 6.11.8 with commit 7eb923f8d4819737c07d6a8d0daef0a4d7f99e0c |
| Issue introduced in 5.1 with commit d4fd0404c1c95b17880f254ebfee3485693fa8ba and fixed in 6.12 with commit e15c5506dd39885cd047f811a64240e2e8ab401b |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-50298 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/net/ethernet/freescale/enetc/enetc_pf.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/ef0edfbe9eeed1fccad7cb705648af5222664944 |
| https://git.kernel.org/stable/c/7eb923f8d4819737c07d6a8d0daef0a4d7f99e0c |
| https://git.kernel.org/stable/c/e15c5506dd39885cd047f811a64240e2e8ab401b |
