Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nf_tables: flush pending destroy work before exit_net release<br /> <br /> Similar to 2c9f0293280e ("netfilter: nf_tables: flush pending destroy<br /> work before netlink notifier") to address a race between exit_net and<br /> the destroy workqueue.<br /> <br /> The trace below shows an element to be released via destroy workqueue<br /> while exit_net path (triggered via module removal) has already released<br /> the set that is used in such transaction.<br /> <br /> [ 1360.547789] BUG: KASAN: slab-use-after-free in nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables]<br /> [ 1360.547861] Read of size 8 at addr ffff888140500cc0 by task kworker/4:1/152465<br /> [ 1360.547870] CPU: 4 PID: 152465 Comm: kworker/4:1 Not tainted 6.8.0+ #359<br /> [ 1360.547882] Workqueue: events nf_tables_trans_destroy_work [nf_tables]<br /> [ 1360.547984] Call Trace:<br /> [ 1360.547991] <br /> [ 1360.547998] dump_stack_lvl+0x53/0x70<br /> [ 1360.548014] print_report+0xc4/0x610<br /> [ 1360.548026] ? __virt_addr_valid+0xba/0x160<br /> [ 1360.548040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10<br /> [ 1360.548054] ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables]<br /> [ 1360.548176] kasan_report+0xae/0xe0<br /> [ 1360.548189] ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables]<br /> [ 1360.548312] nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables]<br /> [ 1360.548447] ? __pfx_nf_tables_trans_destroy_work+0x10/0x10 [nf_tables]<br /> [ 1360.548577] ? _raw_spin_unlock_irq+0x18/0x30<br /> [ 1360.548591] process_one_work+0x2f1/0x670<br /> [ 1360.548610] worker_thread+0x4d3/0x760<br /> [ 1360.548627] ? __pfx_worker_thread+0x10/0x10<br /> [ 1360.548640] kthread+0x16b/0x1b0<br /> [ 1360.548653] ? __pfx_kthread+0x10/0x10<br /> [ 1360.548665] ret_from_fork+0x2f/0x50<br /> [ 1360.548679] ? __pfx_kthread+0x10/0x10<br /> [ 1360.548690] ret_from_fork_asm+0x1a/0x30<br /> [ 1360.548707] <br /> <br /> [ 1360.548719] Allocated by task 192061:<br /> [ 1360.548726] kasan_save_stack+0x20/0x40<br /> [ 1360.548739] kasan_save_track+0x14/0x30<br /> [ 1360.548750] __kasan_kmalloc+0x8f/0xa0<br /> [ 1360.548760] __kmalloc_node+0x1f1/0x450<br /> [ 1360.548771] nf_tables_newset+0x10c7/0x1b50 [nf_tables]<br /> [ 1360.548883] nfnetlink_rcv_batch+0xbc4/0xdc0 [nfnetlink]<br /> [ 1360.548909] nfnetlink_rcv+0x1a8/0x1e0 [nfnetlink]<br /> [ 1360.548927] netlink_unicast+0x367/0x4f0<br /> [ 1360.548935] netlink_sendmsg+0x34b/0x610<br /> [ 1360.548944] ____sys_sendmsg+0x4d4/0x510<br /> [ 1360.548953] ___sys_sendmsg+0xc9/0x120<br /> [ 1360.548961] __sys_sendmsg+0xbe/0x140<br /> [ 1360.548971] do_syscall_64+0x55/0x120<br /> [ 1360.548982] entry_SYSCALL_64_after_hwframe+0x55/0x5d<br /> <br /> [ 1360.548994] Freed by task 192222:<br /> [ 1360.548999] kasan_save_stack+0x20/0x40<br /> [ 1360.549009] kasan_save_track+0x14/0x30<br /> [ 1360.549019] kasan_save_free_info+0x3b/0x60<br /> [ 1360.549028] poison_slab_object+0x100/0x180<br /> [ 1360.549036] __kasan_slab_free+0x14/0x30<br /> [ 1360.549042] kfree+0xb6/0x260<br /> [ 1360.549049] __nft_release_table+0x473/0x6a0 [nf_tables]<br /> [ 1360.549131] nf_tables_exit_net+0x170/0x240 [nf_tables]<br /> [ 1360.549221] ops_exit_list+0x50/0xa0<br /> [ 1360.549229] free_exit_list+0x101/0x140<br /> [ 1360.549236] unregister_pernet_operations+0x107/0x160<br /> [ 1360.549245] unregister_pernet_subsys+0x1c/0x30<br /> [ 1360.549254] nf_tables_module_exit+0x43/0x80 [nf_tables]<br /> [ 1360.549345] __do_sys_delete_module+0x253/0x370<br /> [ 1360.549352] do_syscall_64+0x55/0x120<br /> [ 1360.549360] entry_SYSCALL_64_after_hwframe+0x55/0x5d<br /> <br /> (gdb) list *__nft_release_table+0x473<br /> 0x1e033 is in __nft_release_table (net/netfilter/nf_tables_api.c:11354).<br /> 11349 list_for_each_entry_safe(flowtable, nf, &amp;table-&gt;flowtables, list) {<br /> 11350 list_del(&amp;flowtable-&gt;list);<br /> 11351 nft_use_dec(&amp;table-&gt;use);<br /> 11352 nf_tables_flowtable_destroy(flowtable);<br /> 11353 }<br /> 11354 list_for_each_entry_safe(set, ns, &amp;table-&gt;sets, list) {<br /> 11355 list_del(&amp;set-&gt;list);<br /> 11356 nft_use_dec(&amp;table-&gt;use);<br /> 11357 if (set-&gt;flags &amp; (NFT_SET_MAP | NFT_SET_OBJECT))<br /> 11358 nft_map_deactivat<br /> ---truncated---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: mana: Fix Rx DMA datasize and skb_over_panic<br /> <br /> mana_get_rxbuf_cfg() aligns the RX buffer&amp;#39;s DMA datasize to be<br /> multiple of 64. So a packet slightly bigger than mtu+14, say 1536,<br /> can be received and cause skb_over_panic.<br /> <br /> Sample dmesg:<br /> [ 5325.237162] skbuff: skb_over_panic: text:ffffffffc043277a len:1536 put:1536 head:ff1100018b517000 data:ff1100018b517100 tail:0x700 end:0x6ea dev:<br /> [ 5325.243689] ------------[ cut here ]------------<br /> [ 5325.245748] kernel BUG at net/core/skbuff.c:192!<br /> [ 5325.247838] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI<br /> [ 5325.258374] RIP: 0010:skb_panic+0x4f/0x60<br /> [ 5325.302941] Call Trace:<br /> [ 5325.304389] <br /> [ 5325.315794] ? skb_panic+0x4f/0x60<br /> [ 5325.317457] ? asm_exc_invalid_op+0x1f/0x30<br /> [ 5325.319490] ? skb_panic+0x4f/0x60<br /> [ 5325.321161] skb_put+0x4e/0x50<br /> [ 5325.322670] mana_poll+0x6fa/0xb50 [mana]<br /> [ 5325.324578] __napi_poll+0x33/0x1e0<br /> [ 5325.326328] net_rx_action+0x12e/0x280<br /> <br /> As discussed internally, this alignment is not necessary. To fix<br /> this bug, remove it from the code. So oversized packets will be<br /> marked as CQE_RX_TRUNCATED by NIC, and dropped.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: act_skbmod: prevent kernel-infoleak<br /> <br /> syzbot found that tcf_skbmod_dump() was copying four bytes<br /> from kernel stack to user space [1].<br /> <br /> The issue here is that &amp;#39;struct tc_skbmod&amp;#39; has a four bytes hole.<br /> <br /> We need to clear the structure before filling fields.<br /> <br /> [1]<br /> BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]<br /> BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline]<br /> BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline]<br /> BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]<br /> BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline]<br /> BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185<br /> instrument_copy_to_user include/linux/instrumented.h:114 [inline]<br /> copy_to_user_iter lib/iov_iter.c:24 [inline]<br /> iterate_ubuf include/linux/iov_iter.h:29 [inline]<br /> iterate_and_advance2 include/linux/iov_iter.h:245 [inline]<br /> iterate_and_advance include/linux/iov_iter.h:271 [inline]<br /> _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185<br /> copy_to_iter include/linux/uio.h:196 [inline]<br /> simple_copy_to_iter net/core/datagram.c:532 [inline]<br /> __skb_datagram_iter+0x185/0x1000 net/core/datagram.c:420<br /> skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546<br /> skb_copy_datagram_msg include/linux/skbuff.h:4050 [inline]<br /> netlink_recvmsg+0x432/0x1610 net/netlink/af_netlink.c:1962<br /> sock_recvmsg_nosec net/socket.c:1046 [inline]<br /> sock_recvmsg+0x2c4/0x340 net/socket.c:1068<br /> __sys_recvfrom+0x35a/0x5f0 net/socket.c:2242<br /> __do_sys_recvfrom net/socket.c:2260 [inline]<br /> __se_sys_recvfrom net/socket.c:2256 [inline]<br /> __x64_sys_recvfrom+0x126/0x1d0 net/socket.c:2256<br /> do_syscall_64+0xd5/0x1f0<br /> entry_SYSCALL_64_after_hwframe+0x6d/0x75<br /> <br /> Uninit was stored to memory at:<br /> pskb_expand_head+0x30f/0x19d0 net/core/skbuff.c:2253<br /> netlink_trim+0x2c2/0x330 net/netlink/af_netlink.c:1317<br /> netlink_unicast+0x9f/0x1260 net/netlink/af_netlink.c:1351<br /> nlmsg_unicast include/net/netlink.h:1144 [inline]<br /> nlmsg_notify+0x21d/0x2f0 net/netlink/af_netlink.c:2610<br /> rtnetlink_send+0x73/0x90 net/core/rtnetlink.c:741<br /> rtnetlink_maybe_send include/linux/rtnetlink.h:17 [inline]<br /> tcf_add_notify net/sched/act_api.c:2048 [inline]<br /> tcf_action_add net/sched/act_api.c:2071 [inline]<br /> tc_ctl_action+0x146e/0x19d0 net/sched/act_api.c:2119<br /> rtnetlink_rcv_msg+0x1737/0x1900 net/core/rtnetlink.c:6595<br /> netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2559<br /> rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6613<br /> netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]<br /> netlink_unicast+0xf4c/0x1260 net/netlink/af_netlink.c:1361<br /> netlink_sendmsg+0x10df/0x11f0 net/netlink/af_netlink.c:1905<br /> sock_sendmsg_nosec net/socket.c:730 [inline]<br /> __sock_sendmsg+0x30f/0x380 net/socket.c:745<br /> ____sys_sendmsg+0x877/0xb60 net/socket.c:2584<br /> ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638<br /> __sys_sendmsg net/socket.c:2667 [inline]<br /> __do_sys_sendmsg net/socket.c:2676 [inline]<br /> __se_sys_sendmsg net/socket.c:2674 [inline]<br /> __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674<br /> do_syscall_64+0xd5/0x1f0<br /> entry_SYSCALL_64_after_hwframe+0x6d/0x75<br /> <br /> Uninit was stored to memory at:<br /> __nla_put lib/nlattr.c:1041 [inline]<br /> nla_put+0x1c6/0x230 lib/nlattr.c:1099<br /> tcf_skbmod_dump+0x23f/0xc20 net/sched/act_skbmod.c:256<br /> tcf_action_dump_old net/sched/act_api.c:1191 [inline]<br /> tcf_action_dump_1+0x85e/0x970 net/sched/act_api.c:1227<br /> tcf_action_dump+0x1fd/0x460 net/sched/act_api.c:1251<br /> tca_get_fill+0x519/0x7a0 net/sched/act_api.c:1628<br /> tcf_add_notify_msg net/sched/act_api.c:2023 [inline]<br /> tcf_add_notify net/sched/act_api.c:2042 [inline]<br /> tcf_action_add net/sched/act_api.c:2071 [inline]<br /> tc_ctl_action+0x1365/0x19d0 net/sched/act_api.c:2119<br /> rtnetlink_rcv_msg+0x1737/0x1900 net/core/rtnetlink.c:6595<br /> netlink_rcv_skb+0x375/0x650 net/netlink/af_netli<br /> ---truncated---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nf_tables: reject new basechain after table flag update<br /> <br /> When dormant flag is toggled, hooks are disabled in the commit phase by<br /> iterating over current chains in table (existing and new).<br /> <br /> The following configuration allows for an inconsistent state:<br /> <br /> add table x<br /> add chain x y { type filter hook input priority 0; }<br /> add table x { flags dormant; }<br /> add chain x w { type filter hook input priority 1; }<br /> <br /> which triggers the following warning when trying to unregister chain w<br /> which is already unregistered.<br /> <br /> [ 127.322252] WARNING: CPU: 7 PID: 1211 at net/netfilter/core.c:50 1 __nf_unregister_net_hook+0x21a/0x260<br /> [...]<br /> [ 127.322519] Call Trace:<br /> [ 127.322521] <br /> [ 127.322524] ? __warn+0x9f/0x1a0<br /> [ 127.322531] ? __nf_unregister_net_hook+0x21a/0x260<br /> [ 127.322537] ? report_bug+0x1b1/0x1e0<br /> [ 127.322545] ? handle_bug+0x3c/0x70<br /> [ 127.322552] ? exc_invalid_op+0x17/0x40<br /> [ 127.322556] ? asm_exc_invalid_op+0x1a/0x20<br /> [ 127.322563] ? kasan_save_free_info+0x3b/0x60<br /> [ 127.322570] ? __nf_unregister_net_hook+0x6a/0x260<br /> [ 127.322577] ? __nf_unregister_net_hook+0x21a/0x260<br /> [ 127.322583] ? __nf_unregister_net_hook+0x6a/0x260<br /> [ 127.322590] ? __nf_tables_unregister_hook+0x8a/0xe0 [nf_tables]<br /> [ 127.322655] nft_table_disable+0x75/0xf0 [nf_tables]<br /> [ 127.322717] nf_tables_commit+0x2571/0x2620 [nf_tables]

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nf_tables: discard table flag update with pending basechain deletion<br /> <br /> Hook unregistration is deferred to the commit phase, same occurs with<br /> hook updates triggered by the table dormant flag. When both commands are<br /> combined, this results in deleting a basechain while leaving its hook<br /> still registered in the core.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> of: module: prevent NULL pointer dereference in vsnprintf()<br /> <br /> In of_modalias(), we can get passed the str and len parameters which would<br /> cause a kernel oops in vsnprintf() since it only allows passing a NULL ptr<br /> when the length is also 0. Also, we need to filter out the negative values<br /> of the len parameter as these will result in a really huge buffer since<br /> snprintf() takes size_t parameter while ours is ssize_t...<br /> <br /> Found by Linux Verification Center (linuxtesting.org) with the Svace static<br /> analysis tool.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> io_uring/kbuf: hold io_buffer_list reference over mmap<br /> <br /> If we look up the kbuf, ensure that it doesn&amp;#39;t get unregistered until<br /> after we&amp;#39;re done with it. Since we&amp;#39;re inside mmap, we cannot safely use<br /> the io_uring lock. Rely on the fact that we can lookup the buffer list<br /> under RCU now and grab a reference to it, preventing it from being<br /> unregistered until we&amp;#39;re done with it. The lookup returns the<br /> io_buffer_list directly with it referenced.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP<br /> <br /> Jan Schunk reports that his small NFS servers suffer from memory<br /> exhaustion after just a few days. A bisect shows that commit<br /> e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single<br /> sock_sendmsg() call") is the first bad commit.<br /> <br /> That commit assumed that sock_sendmsg() releases all the pages in<br /> the underlying bio_vec array, but the reality is that it doesn&amp;#39;t.<br /> svc_xprt_release() releases the rqst&amp;#39;s response pages, but the<br /> record marker page fragment isn&amp;#39;t one of those, so it is never<br /> released.<br /> <br /> This is a narrow fix that can be applied to stable kernels. A<br /> more extensive fix is in the works.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe<br /> <br /> In function pci1xxxx_spi_probe, there is a potential null pointer that<br /> may be caused by a failed memory allocation by the function devm_kzalloc.<br /> Hence, a null pointer check needs to be added to prevent null pointer<br /> dereferencing later in the code.<br /> <br /> To fix this issue, spi_bus-&gt;spi_int[iter] should be checked. The memory<br /> allocated by devm_kzalloc will be automatically released, so just directly<br /> return -ENOMEM without worrying about memory leaks.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mlxbf_gige: stop interface during shutdown<br /> <br /> The mlxbf_gige driver intermittantly encounters a NULL pointer<br /> exception while the system is shutting down via "reboot" command.<br /> The mlxbf_driver will experience an exception right after executing<br /> its shutdown() method. One example of this exception is:<br /> <br /> Unable to handle kernel NULL pointer dereference at virtual address 0000000000000070<br /> Mem abort info:<br /> ESR = 0x0000000096000004<br /> EC = 0x25: DABT (current EL), IL = 32 bits<br /> SET = 0, FnV = 0<br /> EA = 0, S1PTW = 0<br /> FSC = 0x04: level 0 translation fault<br /> Data abort info:<br /> ISV = 0, ISS = 0x00000004<br /> CM = 0, WnR = 0<br /> user pgtable: 4k pages, 48-bit VAs, pgdp=000000011d373000<br /> [0000000000000070] pgd=0000000000000000, p4d=0000000000000000<br /> Internal error: Oops: 96000004 [#1] SMP<br /> CPU: 0 PID: 13 Comm: ksoftirqd/0 Tainted: G S OE 5.15.0-bf.6.gef6992a #1<br /> Hardware name: https://www.mellanox.com BlueField SoC/BlueField SoC, BIOS 4.0.2.12669 Apr 21 2023<br /> pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> pc : mlxbf_gige_handle_tx_complete+0xc8/0x170 [mlxbf_gige]<br /> lr : mlxbf_gige_poll+0x54/0x160 [mlxbf_gige]<br /> sp : ffff8000080d3c10<br /> x29: ffff8000080d3c10 x28: ffffcce72cbb7000 x27: ffff8000080d3d58<br /> x26: ffff0000814e7340 x25: ffff331cd1a05000 x24: ffffcce72c4ea008<br /> x23: ffff0000814e4b40 x22: ffff0000814e4d10 x21: ffff0000814e4128<br /> x20: 0000000000000000 x19: ffff0000814e4a80 x18: ffffffffffffffff<br /> x17: 000000000000001c x16: ffffcce72b4553f4 x15: ffff80008805b8a7<br /> x14: 0000000000000000 x13: 0000000000000030 x12: 0101010101010101<br /> x11: 7f7f7f7f7f7f7f7f x10: c2ac898b17576267 x9 : ffffcce720fa5404<br /> x8 : ffff000080812138 x7 : 0000000000002e9a x6 : 0000000000000080<br /> x5 : ffff00008de3b000 x4 : 0000000000000000 x3 : 0000000000000001<br /> x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000<br /> Call trace:<br /> mlxbf_gige_handle_tx_complete+0xc8/0x170 [mlxbf_gige]<br /> mlxbf_gige_poll+0x54/0x160 [mlxbf_gige]<br /> __napi_poll+0x40/0x1c8<br /> net_rx_action+0x314/0x3a0<br /> __do_softirq+0x128/0x334<br /> run_ksoftirqd+0x54/0x6c<br /> smpboot_thread_fn+0x14c/0x190<br /> kthread+0x10c/0x110<br /> ret_from_fork+0x10/0x20<br /> Code: 8b070000 f9000ea0 f95056c0 f86178a1 (b9407002)<br /> ---[ end trace 7cc3941aa0d8e6a4 ]---<br /> Kernel panic - not syncing: Oops: Fatal exception in interrupt<br /> Kernel Offset: 0x4ce722520000 from 0xffff800008000000<br /> PHYS_OFFSET: 0x80000000<br /> CPU features: 0x000005c1,a3330e5a<br /> Memory Limit: none<br /> ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---<br /> <br /> During system shutdown, the mlxbf_gige driver&amp;#39;s shutdown() is always executed.<br /> However, the driver&amp;#39;s stop() method will only execute if networking interface<br /> configuration logic within the Linux distribution has been setup to do so.<br /> <br /> If shutdown() executes but stop() does not execute, NAPI remains enabled<br /> and this can lead to an exception if NAPI is scheduled while the hardware<br /> interface has only been partially deinitialized.<br /> <br /> The networking interface managed by the mlxbf_gige driver must be properly<br /> stopped during system shutdown so that IFF_UP is cleared, the hardware<br /> interface is put into a clean state, and NAPI is fully deinitialized.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ax25: fix use-after-free bugs caused by ax25_ds_del_timer<br /> <br /> When the ax25 device is detaching, the ax25_dev_device_down()<br /> calls ax25_ds_del_timer() to cleanup the slave_timer. When<br /> the timer handler is running, the ax25_ds_del_timer() that<br /> calls del_timer() in it will return directly. As a result,<br /> the use-after-free bugs could happen, one of the scenarios<br /> is shown below:<br /> <br /> (Thread 1) | (Thread 2)<br /> | ax25_ds_timeout()<br /> ax25_dev_device_down() |<br /> ax25_ds_del_timer() |<br /> del_timer() |<br /> ax25_dev_put() //FREE |<br /> | ax25_dev-&gt; //USE<br /> <br /> In order to mitigate bugs, when the device is detaching, use<br /> timer_shutdown_sync() to stop the timer.