Vulnerabilidades

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: btusb: fix use-after-free on registration failure<br /> <br /> Make sure to release the sibling interfaces in case controller<br /> registration fails to avoid use-after-free and double-free when they are<br /> eventually disconnected.<br /> <br /> This issue was reported by Sashiko while reviewing a fix for a wakeup<br /> source leak in the btusb probe errors paths.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vfio/mlx5: Fix racy bitfields and tighten struct layout<br /> <br /> Bitfield operations are not atomic, they use a read-modify-write<br /> pattern, therefore we should be careful not to pack bitfields that<br /> can be concurrently updated into the same storage unit.<br /> <br /> This split takes a binary approach: flags that are only modified<br /> pre/post open/close remain bitfields, flags modified from user<br /> action, including actions that reach across to another device (ex.<br /> reset) use dedicated storage units.<br /> <br /> Note mlx5_vhca_page_tracker.status is relocated to fill the alignment<br /> hole this split exposes.<br /> <br /> Bitfield justifications:<br /> <br /> migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe<br /> chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe<br /> mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe<br /> <br /> Dedicated storage units:<br /> <br /> mdev_detach: written in the VF attach/detach event notifier<br /> mlx5fv_vf_event() at runtime<br /> log_active: written in mlx5vf_start_page_tracker()/<br /> mlx5vf_stop_page_tracker() during runtime dirty tracking<br /> deferred_reset: written in mlx5vf_state_mutex_unlock()/<br /> mlx5vf_pci_aer_reset_done() during runtime reset handling<br /> is_err: set by tracker error handling and dirty-log polling at runtime<br /> object_changed: set by tracker event handling and cleared by dirty-log<br /> polling at runtime

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vfio: Remove device debugfs before releasing devres<br /> <br /> VFIO device debugfs files created with debugfs_create_devm_seqfile()<br /> store a devres allocated debugfs_devm_entry as inode private data.<br /> vfio_unregister_group_dev() currently calls vfio_device_del() before<br /> vfio_device_debugfs_exit(), but device_del() releases devres. This can<br /> leave debugfs entries visible with stale inode private data while<br /> unregister waits for userspace references to drain.<br /> <br /> Remove the per-device debugfs tree before vfio_device_del(). The debugfs<br /> view is diagnostic only, so losing it at the start of unregister is<br /> preferable to preserving entries whose backing storage may already have<br /> been released.<br /> <br /> Complete the teardown by clearing the per-device debugfs root after<br /> removal. This matches the global debugfs root cleanup and prevents<br /> future users from mistaking a removed dentry for a live debugfs tree<br /> during the remainder of unregister.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc<br /> <br /> vfio_mig_get_next_state() walks vfio_from_fsm_table[] one step at a time,<br /> looping to skip optional states the device does not support until<br /> *next_fsm is supported. A blocked transition is encoded as<br /> VFIO_DEVICE_STATE_ERROR, which the trailing return reports as -EINVAL.<br /> <br /> The skip loop does not account for the ERROR sentinel.<br /> state_flags_table[ERROR] is ~0U and vfio_from_fsm_table[ERROR][*] is<br /> ERROR, so once *next_fsm becomes ERROR the loop condition stays true and<br /> *next_fsm never changes. The blocked arcs STOP_COPY -&gt; PRE_COPY and<br /> STOP_COPY -&gt; PRE_COPY_P2P map to ERROR yet pass the support check on a<br /> precopy-capable device, causing the loop to spin forever while holding<br /> the driver state mutex. This can result in a soft lockup, and a panic<br /> with softlockup_panic set.<br /> <br /> Terminate the skip loop on the ERROR sentinel so a blocked transition<br /> falls through to the existing return and reports -EINVAL.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vfio/pci: Release the VGA arbiter client on register_device() failure<br /> <br /> The re-order in the Fixes commit below displaced vfio_pci_vga_init() as<br /> the last failure point of what is now vfio_pci_core_register_device()<br /> without introducing an unwind for the VGA arbiter registration.<br /> <br /> In current kernels this is mostly benign because vfio_pci_set_decode()<br /> only uses pci_dev state, but the original failure path could leave a<br /> callback with a freed vdev cookie. The stale registration also becomes<br /> unsafe again once the callback follows drvdata to the vfio device.<br /> <br /> Add the required VGA unwind callout.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tcp: restore RCU grace period in tcp_ao_destroy_sock<br /> <br /> Commit 51e547e8c89c ("tcp: Free TCP-AO/TCP-MD5 info/keys without RCU")<br /> removed the call_rcu() callback from tcp_ao_destroy_sock(), arguing that<br /> "the destruction of info/keys is delayed until the socket destructor"<br /> and therefore "no one can discover it anymore".<br /> <br /> That argument does not hold for the call site in tcp_connect()<br /> (net/ipv4/tcp_output.c:4327-4332). At that point the socket is in<br /> TCP_SYN_SENT, has already been inserted into the inet ehash by<br /> inet_hash_connect() in tcp_v4_connect(), and is therefore very much<br /> discoverable: any softirq running tcp_v4_rcv() on another CPU can take<br /> the socket out of the ehash, walk into tcp_inbound_hash(), and load<br /> tp-&gt;ao_info via implicit RCU before bh_lock_sock_nested() is taken on<br /> the destroying CPU.<br /> <br /> The reader path then enters __tcp_ao_do_lookup() (net/ipv4/tcp_ao.c:208)<br /> which re-loads tp-&gt;ao_info via rcu_dereference_check(); the re-load can<br /> still observe the (about-to-be-freed) pointer because there is no<br /> synchronize_rcu() between rcu_assign_pointer(tp-&gt;ao_info, NULL) and<br /> tcp_ao_info_free() in tcp_ao_destroy_sock(). The captured pointer is<br /> then walked at line 223:<br /> <br /> hlist_for_each_entry_rcu(key, &amp;ao-&gt;head, node, ...)<br /> <br /> The writer&amp;#39;s synchronous kfree() is free to complete between the line<br /> 218 re-fetch and the line 223 hlist iteration. The slab is reused<br /> (or simply LIST_POISON1-stamped if not yet reused) and the iteration<br /> walks attacker-controlled or poison memory in softirq context.<br /> <br /> Reproducer (no debug shim, stock x86_64 v7.1-rc2 SMP+KASAN, QEMU+KVM):<br /> an unprivileged uid=1000 process inside CLONE_NEWUSER|CLONE_NEWNET<br /> installs TCP_MD5SIG + TCP_AO_ADD_KEY on a TCP socket, sprays forged<br /> TCP-AO segments toward its eventual 4-tuple via raw sockets, then<br /> calls connect(). The md5-wins reconciliation in tcp_connect() fires<br /> tcp_ao_destroy_sock(); the softirq backlog reader on the loopback<br /> NAPI path crashes on the freed ao-&gt;head.first walk:<br /> <br /> Oops: general protection fault, probably for non-canonical<br /> address 0xfbd59c000000002f<br /> KASAN: maybe wild-memory-access in range<br /> [0xdead000000000178-0xdead00000000017f]<br /> CPU: 0 UID: 1000 PID: 100 Comm: repro_userns<br /> RIP: 0010:__tcp_ao_do_lookup+0x107/0x1c0<br /> Call Trace: <br /> __tcp_ao_do_lookup+0x107/0x1c0<br /> tcp_ao_inbound_lookup.constprop.0+0x12a/0x200<br /> tcp_inbound_ao_hash+0x5ea/0x1520<br /> tcp_inbound_hash+0x7ce/0x1240<br /> tcp_v4_rcv+0x1e7a/0x3e10<br /> ...<br /> <br /> Restore the RCU grace period: re-add struct rcu_head to tcp_ao_info<br /> and replace the synchronous tcp_ao_info_free() with a call_rcu()<br /> callback. Readers that captured tp-&gt;ao_info before rcu_assign_pointer<br /> NULLed it now see the object remain valid until rcu_read_unlock().<br /> With the patch applied the reproducer runs cleanly for 2000 iterations<br /> on the same kernel build.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> PCI/IOV: Skip VF Resizable BAR restore on read error<br /> <br /> sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register<br /> to decide how many VF BARs to restore (nbars) and which VF BAR each<br /> iteration addresses (bar_idx). bar_idx indexes into dev-&gt;sriov-&gt;barsz[],<br /> which has only PCI_SRIOV_NUM_BARS (6) entries.<br /> <br /> When a device does not respond, config reads typically return<br /> PCI_ERROR_RESPONSE (~0). Both fields are 3 bits wide, so nbars and bar_idx<br /> both evaluate to 7. The barsz[] access then goes out of bounds. UBSAN<br /> reports this as:<br /> <br /> UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type &amp;#39;resource_size_t [6]&amp;#39;<br /> <br /> Observed on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding<br /> during a failed GC6 power state exit. The subsequent pci_restore_state()<br /> invoked sriov_restore_vf_rebar_state() while config reads returned<br /> 0xffffffff, triggering the splat.<br /> <br /> Bail out if any VF Resizable BAR Control read returns PCI_ERROR_RESPONSE.<br /> No further VF BARs are touched, which is safe because a config read that<br /> returns PCI_ERROR_RESPONSE indicates the device is unreachable and<br /> restoration is pointless. This mirrors the guard in<br /> pci_restore_rebar_state().

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> PCI: mediatek: Fix IRQ domain leak when port fails to enable<br /> <br /> When mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port<br /> from pcie-&gt;ports and frees the port structure. However, the IRQ domains set<br /> up earlier by mtk_pcie_init_irq_domain() are never freed.<br /> <br /> Fix this by refactoring mtk_pcie_irq_teardown() into a per-port helper,<br /> mtk_pcie_irq_teardown_port(), and calling it from mtk_pcie_setup() when<br /> mtk_pcie_enable_port() fails. Since the IRQ teardown must only happen in<br /> the probe error path (during resume, child devices may have active MSI<br /> mappings and the NOIRQ context prohibits sleeping locks),<br /> mtk_pcie_enable_port() is changed to return an error code so callers can<br /> distinguish the two paths and act accordingly.<br /> <br /> This issue was reported by Sashiko while reviewing the EcoNet EN7528 SoC<br /> support series.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> PCI: altera: Fix resource leaks on probe failure<br /> <br /> The chained IRQ handler is set during probe, but is only removed during the<br /> driver remove(). If pci_host_probe() fails, the handler and INTx IRQ<br /> domain remain set even though the devm-managed host bridge storage<br /> containing struct altera_pcie will be released, leaving the handler with<br /> a stale data pointer.<br /> <br /> Interrupts are also enabled before pci_host_probe() is called. If probe<br /> fails after that point, the controller interrupt source should be disabled<br /> before the chained handler and INTx domain are removed.<br /> <br /> So set the chained handler only after the INTx domain has been created.<br /> Disable controller interrupts during IRQ teardown, and tear the IRQ setup<br /> down if pci_host_probe() fails.<br /> <br /> [mani: commit log]

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: typec: tcpci_rt1711h: unregister TCPCI port with devres<br /> <br /> rt1711h_probe() registers the TCPCI port before requesting the interrupt<br /> and enabling alert interrupts. If either of those later steps fails, the<br /> probe function returns without unregistering the TCPCI port. The explicit<br /> unregister currently only happens from the remove callback.<br /> <br /> Register a devres action immediately after tcpci_register_port() succeeds,<br /> so tcpci_unregister_port() runs on later probe failures and on driver<br /> detach. Drop the remove callback to avoid unregistering the same port<br /> twice.<br /> <br /> This issue was identified during our ongoing static-analysis research while<br /> reviewing kernel code.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xhci: sideband: fix ring sg table pages leak<br /> <br /> xhci_ring_to_sgtable() allocates a temporary pages array and<br /> uses it to build the returned sg_table with<br /> sg_alloc_table_from_pages().<br /> <br /> The error paths free the pages array, but the success path<br /> returns the sg_table without freeing it. This leaks the temporary<br /> array every time a sideband client gets an endpoint or event ring<br /> buffer.<br /> <br /> Free the pages array after sg_alloc_table_from_pages() succeeds.<br /> The returned sg_table has its own scatterlist entries and does not<br /> depend on the temporary array after construction.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: xhci: Fix sleep in atomic context in xhci_free_streams()<br /> <br /> When a USB device with active stream endpoints is disconnected,<br /> xhci_free_streams() is called from the hub_event workqueue to<br /> free the stream resources. It calls xhci_free_stream_info()<br /> while holding xhci-&gt;lock with irqs disabled.<br /> <br /> xhci_free_stream_info() invokes xhci_free_stream_ctx(), which<br /> calls dma_free_coherent() for large stream context arrays.<br /> <br /> dma_free_coherent() can sleep (e.g. via vunmap), triggering<br /> a BUG when called from atomic context.<br /> <br /> Call trace:<br /> dma_free_attrs+0x174/0x220<br /> xhci_free_stream_info+0xd0/0x11c<br /> xhci_free_streams+0x278/0x37c<br /> usb_free_streams+0x98/0xc0<br /> usb_unbind_interface+0x1b8/0x2f8<br /> device_release_driver_internal+0x1d4/0x2cc<br /> device_release_driver+0x18/0x28<br /> bus_remove_device+0x160/0x1a4<br /> device_del+0x1ec/0x350<br /> usb_disable_device+0x98/0x214<br /> usb_disconnect+0xf0/0x35c<br /> hub_event+0xab4/0x19ec<br /> process_one_work+0x278/0x63c<br /> <br /> Fix this by saving the stream_info pointers and clearing the<br /> ep references under the lock, then calling xhci_free_stream_info()<br /> outside the lock where sleeping is allowed.