| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024041701-CVE-2024-26820-fc5a@gregkh> Date: Wed, 17 Apr 2024 11:44:03 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-26820: hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed Description =========== In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed If hv_netvsc driver is unloaded and reloaded, the NET_DEVICE_REGISTER handler cannot perform VF register successfully as the register call is received before netvsc_probe is finished. This is because we register register_netdevice_notifier() very early( even before vmbus_driver_register()). To fix this, we try to register each such matching VF( if it is visible as a netdevice) at the end of netvsc_probe. The Linux kernel CVE team has assigned CVE-2024-26820 to this issue. Affected and fixed versions =========================== Issue introduced in 4.19.301 with commit 028aa21f9e92 and fixed in 4.19.310 with commit bcb7164258d0 Issue introduced in 5.4.263 with commit 997d895fa495 and fixed in 5.4.272 with commit c7441c77c91e Issue introduced in 5.10.203 with commit ff6c130e48a7 and fixed in 5.10.213 with commit 5b10a88f64c0 Issue introduced in 5.15.141 with commit 97683466e24c and fixed in 5.15.152 with commit b6d46f306b39 Issue introduced in 6.1.65 with commit 5dd83db613be and fixed in 6.1.79 with commit 309ef7de5d84 Issue introduced in 6.6.4 with commit 7350c460f7f4 and fixed in 6.6.18 with commit a71302c86389 Issue introduced in 6.7 with commit 85520856466e and fixed in 6.7.6 with commit 4d29a58d96a7 Issue introduced in 6.7 with commit 85520856466e and fixed in 6.8 with commit 9cae43da9867 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-26820 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/hyperv/netvsc_drv.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/bcb7164258d0a9a8aa2e73ddccc2d78f67d2519d https://git.kernel.org/stable/c/c7441c77c91e47f653104be8353b44a3366a5366 https://git.kernel.org/stable/c/5b10a88f64c0315cfdef45de0aaaa4eef57de0b7 https://git.kernel.org/stable/c/b6d46f306b3964d05055ddaa96b58cd8bd3a472c https://git.kernel.org/stable/c/309ef7de5d840e17607e7d65cbf297c0564433ef https://git.kernel.org/stable/c/a71302c8638939c45e4ba5a99ea438185fd3f418 https://git.kernel.org/stable/c/4d29a58d96a78728cb01ee29ed70dc4bd642f135 https://git.kernel.org/stable/c/9cae43da9867412f8bd09aee5c8a8dc5e8dc3dc2
Powered by blists - more mailing lists