Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ethtool: module: call ethnl_ops_complete() on module flash errors<br /> <br /> When validate() fails we are skipping over ethnl_ops_complete()<br /> even tho we already called ethnl_ops_begin().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ethtool: rss: fix indir_table and hkey leak on get_rxfh failure<br /> <br /> rss_prepare_get() allocates the indirection table and hash key buffer<br /> via rss_get_data_alloc(), then calls ops-&gt;get_rxfh() to populate them.<br /> If get_rxfh() fails, the function returns an error without freeing<br /> the allocation.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: hsr: fix potential OOB access in supervision frame handling<br /> <br /> Ensure the entire TLV header is linearized before access by adding<br /> sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this,<br /> a truncated frame could cause an out-of-bounds access.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: pcm: oss: Fix setup list UAF on proc write error<br /> <br /> snd_pcm_oss_proc_write() links a newly allocated setup entry into the<br /> OSS setup list before duplicating the task name. If the task-name<br /> allocation fails, the error path frees the already linked entry and<br /> leaves setup_list pointing at freed memory.<br /> <br /> A later OSS device open can then walk the stale list entry in<br /> snd_pcm_oss_look_for_setup() and dereference freed memory.<br /> <br /> Allocate the task name and initialize the setup entry before publishing<br /> the entry on setup_list. Also fetch the initial proc read iterator only<br /> after taking setup_mutex, so all setup_list traversal follows the same<br /> list lifetime rules.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv4: free net-&gt;ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()<br /> <br /> ipv4_sysctl_exit_net() is currently freeing net-&gt;ipv4.sysctl_local_reserved_ports<br /> too soon.<br /> <br /> Only after unregister_net_sysctl_table() we can be sure no threads can possibly<br /> use the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues<br /> <br /> While a SCSI host is in a recovery state, scsi_mq_requeue_cmd() will not<br /> set the requeue list for a requeued command to be kicked in the future.<br /> The expectation is a call to scsi_run_host_queues() will kick all SCSI<br /> devices once the recovery state is cleared.<br /> <br /> However, scsi_run_host_queues() uses shost_for_each_device() which uses<br /> scsi_device_get() and so will ignore devices in a partially removed<br /> state like SDEV_CANCEL. But these devices may also have requeued<br /> requests, leaving their requests stuck from not being kicked and causing<br /> the removal process of the device to hang.<br /> <br /> scsi_run_host_queues() needs to run against more devices than the macro<br /> shost_for_each_device() allows. Instead of using the too limiting<br /> scsi_device_get() state checks, only ignore devices in SDEV_DEL state or<br /> when unable to acquire a reference. Attempt to run the queues for all<br /> other devices when scsi_run_host_queues() is called.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()<br /> <br /> In some cases, iptunnel_pmtud_check_icmp() can be called while<br /> skb transport header is not set.<br /> <br /> This triggers an out-of-bound access, because<br /> (typeof(skb-&gt;transport_header))~0U is 65535.<br /> <br /> Access the icmp header based on IPv4 network header,<br /> after making sure icmp-&gt;type is present in skb linear part.<br /> <br /> Note that iptunnel_pmtud_check_icmpv6()) is fine.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()<br /> <br /> skb_tunnel_check_pmtu() can change skb-&gt;head.<br /> <br /> Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF.<br /> <br /> Use instead ip_hdr(skb) as done in drivers/net/bareudp.c<br /> and drivers/net/geneve.c.<br /> <br /> Found by Sashiko.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()<br /> <br /> Sashiko found that iptunnel_pmtud_build_icmp() and<br /> iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr()<br /> before an skb_cow() call which can reallocate skb-&gt;head.<br /> <br /> Fix this possible UAF by initializing the local variables<br /> after the skb_cow() call.<br /> <br /> Remove skb_reset_network_header() calls which were not needed.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()<br /> <br /> The skb_clone() function can return NULL if memory allocation fails.<br /> send_mcast_pkt() calls skb_clone() without checking the return value, which<br /> can lead to a NULL pointer dereference in send_pkt() when it dereferences<br /> skb-&gt;data.<br /> Add a NULL check after skb_clone() and skip the peer if the clone fails.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bridge: Fix sleep in atomic context in sysfs path<br /> <br /> Since the start of the git history, brport_store() always acquired the<br /> bridge lock. Back then this decision made sense: The bridge lock<br /> protects the STP state of the bridge and its ports and at that time the<br /> function was only used by two STP related attributes (cost and<br /> priority).<br /> <br /> Nowadays, brport_store() processes a lot more attributes and most of<br /> them do not need the bridge lock:<br /> <br /> * Bridge flags: Only require RTNL. Read locklessly by the data path.<br /> Annotations can be added in net-next.<br /> <br /> * FDB port flushing: Only requires the FDB lock.<br /> <br /> * Multicast attributes: Only require the multicast lock.<br /> <br /> * Group forward mask: Only requires RTNL. Read locklessly by the data<br /> path. Annotations can be added in net-next.<br /> <br /> * Backup port: Only requires RTNL. Read locklessly by the data path.<br /> <br /> This is a problem as the bridge calls dev_set_promiscuity() when certain<br /> bridge port flags change and this function can sleep since the commit<br /> cited below, resulting in a splat such as [1].<br /> <br /> Fix this by reducing the scope of the bridge lock and only take it when<br /> processing the two STP related attributes that require it. Remove the<br /> now stale comment from br_switchdev_set_port_flag(). The<br /> SWITCHDEV_F_DEFER flag can be removed in net-next.<br /> <br /> [1]<br /> BUG: sleeping function called from invalid context at net/core/dev_addr_lists.c:1262<br /> in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 372, name: bash<br /> preempt_count: 201, expected: 0<br /> RCU nest depth: 0, expected: 0<br /> 5 locks held by bash/372:<br /> #0: ffff88810c51c3f0 (sb_writers#7){.+.+}-{0:0}, at: ksys_write (fs/read_write.c:740)<br /> #1: ffff888115ce9480 (&amp;of-&gt;mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter (fs/kernfs/file.c:343)<br /> #2: ffff88810b9fd330 (kn-&gt;active#37){.+.+}-{0:0}, at: kernfs_fop_write_iter (fs/kernfs/file.c:80 fs/kernfs/file.c:344)<br /> #3: ffffffffa59473a0 (rtnl_mutex){+.+.}-{4:4}, at: brport_store (net/bridge/br_sysfs_if.c:326)<br /> #4: ffff8881099d2d58 (&amp;br-&gt;lock){+...}-{3:3}, at: brport_store (./include/linux/spinlock.h:348 net/bridge/br_sysfs_if.c:345)<br /> Preemption disabled at:<br /> 0x0<br /> Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011<br /> Call Trace:<br /> <br /> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)<br /> __might_resched.cold (kernel/sched/core.c:9163)<br /> netif_rx_mode_run (net/core/dev_addr_lists.c:1262)<br /> netif_rx_mode_sync (net/core/dev_addr_lists.c:1428)<br /> dev_set_promiscuity (net/core/dev_api.c:289)<br /> br_manage_promisc (net/bridge/br_if.c:135 net/bridge/br_if.c:172)<br /> br_port_flags_change (net/bridge/br_if.c:242 net/bridge/br_if.c:747)<br /> store_learning (net/bridge/br_sysfs_if.c:79 net/bridge/br_sysfs_if.c:235)<br /> brport_store (net/bridge/br_sysfs_if.c:346)<br /> kernfs_fop_write_iter (fs/kernfs/file.c:352)<br /> new_sync_write (fs/read_write.c:595)<br /> vfs_write (fs/read_write.c:688)<br /> ksys_write (fs/read_write.c:740)<br /> do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)<br /> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bridge: Fix sleep in atomic context in netlink path<br /> <br /> Since the introduction of the netlink configuration path for bridge<br /> ports in commit 25c71c75ac87 ("bridge: bridge port parameters over<br /> netlink"), br_setport() was always called with the bridge lock held<br /> around it. Back then this decision made sense: The bridge lock protects<br /> the STP state of the bridge and its ports and at that time the function<br /> only processed three STP related netlink attributes (cost, priority and<br /> state).<br /> <br /> Nowadays, br_setport() processes a lot more attributes and most of them<br /> do not need the bridge lock:<br /> <br /> * Bridge flags: Only require RTNL. Read locklessly by the data path.<br /> Annotations can be added in net-next.<br /> <br /> * FDB port flushing: Only requires the FDB lock.<br /> <br /> * Multicast attributes: Only require the multicast lock.<br /> <br /> * Group forward mask: Only requires RTNL. Read locklessly by the data<br /> path. Annotations can be added in net-next.<br /> <br /> * Backup port and NHID: Only require RTNL. Read locklessly by the data<br /> path.<br /> <br /> This is a problem as the bridge calls dev_set_promiscuity() when certain<br /> bridge port flags change and this function can sleep since the commit<br /> cited below, resulting in a splat such as [1].<br /> <br /> Fix this by reducing the scope of the bridge lock and only take it when<br /> processing the three STP related attributes that require it. This is<br /> consistent with the multicast attributes where each attribute acquires<br /> the multicast lock instead of having one critical section for all<br /> relevant attributes.<br /> <br /> [1]<br /> BUG: sleeping function called from invalid context at net/core/dev_addr_lists.c:1262<br /> in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 356, name: bridge<br /> preempt_count: 201, expected: 0<br /> RCU nest depth: 0, expected: 0<br /> 2 locks held by bridge/356:<br /> #0: ffffffff919473a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg (net/core/rtnetlink.c:80 net/core/rtnetlink.c:7002)<br /> #1: ffff888115072d58 (&amp;br-&gt;lock){+...}-{3:3}, at: br_setlink (./include/linux/spinlock.h:348 net/bridge/br_netlink.c:1117)<br /> Preemption disabled at:<br /> 0x0<br /> Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011<br /> Call Trace:<br /> <br /> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)<br /> __might_resched.cold (kernel/sched/core.c:9163)<br /> netif_rx_mode_run (net/core/dev_addr_lists.c:1262)<br /> netif_rx_mode_sync (net/core/dev_addr_lists.c:1428)<br /> dev_set_promiscuity (net/core/dev_api.c:289)<br /> br_manage_promisc (net/bridge/br_if.c:135 net/bridge/br_if.c:172)<br /> br_port_flags_change (net/bridge/br_if.c:242 net/bridge/br_if.c:747)<br /> br_setport (net/bridge/br_netlink.c:1000)<br /> br_setlink (net/bridge/br_netlink.c:1118)<br /> rtnl_bridge_setlink (net/core/rtnetlink.c:5572)<br /> rtnetlink_rcv_msg (net/core/rtnetlink.c:7005)<br /> netlink_rcv_skb (net/netlink/af_netlink.c:2550)<br /> netlink_unicast (net/netlink/af_netlink.c:1318 net/netlink/af_netlink.c:1344)<br /> netlink_sendmsg (net/netlink/af_netlink.c:1894)<br /> __sock_sendmsg (net/socket.c:787 (discriminator 4) net/socket.c:802 (discriminator 4))<br /> ____sys_sendmsg (net/socket.c:2698)<br /> ___sys_sendmsg (net/socket.c:2752)<br /> __sys_sendmsg (net/socket.c:2784)<br /> do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)<br /> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)