linux-cve-announce - CVE-2024-35853: mlxsw: spectrum_acl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024051740-CVE-2024-35853-869a@gregkh>
Date: Fri, 17 May 2024 16:47:46 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-35853: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum_acl_tcam: Fix memory leak during rehash

The rehash delayed work migrates filters from one region to another.
This is done by iterating over all chunks (all the filters with the same
priority) in the region and in each chunk iterating over all the
filters.

If the migration fails, the code tries to migrate the filters back to
the old region. However, the rollback itself can also fail in which case
another migration will be erroneously performed. Besides the fact that
this ping pong is not a very good idea, it also creates a problem.

Each virtual chunk references two chunks: The currently used one
('vchunk->chunk') and a backup ('vchunk->chunk2'). During migration the
first holds the chunk we want to migrate filters to and the second holds
the chunk we are migrating filters from.

The code currently assumes - but does not verify - that the backup chunk
does not exist (NULL) if the currently used chunk does not reference the
target region. This assumption breaks when we are trying to rollback a
rollback, resulting in the backup chunk being overwritten and leaked
[1].

Fix by not rolling back a failed rollback and add a warning to avoid
future cases.

[1]
WARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20
Modules linked in:
CPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G        W          6.9.0-rc2-custom-00784-gc6a05c468a0b #14
Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019
Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work
RIP: 0010:parman_destroy+0x17/0x20
[...]
Call Trace:
 <TASK>
 mlxsw_sp_acl_atcam_region_fini+0x19/0x60
 mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0
 mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470
 process_one_work+0x151/0x370
 worker_thread+0x2cb/0x3e0
 kthread+0xd0/0x100
 ret_from_fork+0x34/0x50
 ret_from_fork_asm+0x1a/0x30
 </TASK>

The Linux kernel CVE team has assigned CVE-2024-35853 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 5.1 with commit 843500518509 and fixed in 5.4.275 with commit c6f3fa7f5a74
	Issue introduced in 5.1 with commit 843500518509 and fixed in 5.10.216 with commit 617e98ba4c50
	Issue introduced in 5.1 with commit 843500518509 and fixed in 5.15.158 with commit 413a01886c39
	Issue introduced in 5.1 with commit 843500518509 and fixed in 6.1.90 with commit b822644fd909
	Issue introduced in 5.1 with commit 843500518509 and fixed in 6.6.30 with commit 0ae8ff7b6d42
	Issue introduced in 5.1 with commit 843500518509 and fixed in 6.8.9 with commit b3fd51f684a0
	Issue introduced in 5.1 with commit 843500518509 and fixed in 6.9 with commit 8ca3f7a7b613

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-35853
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c6f3fa7f5a748bf6e5c4eb742686d6952f854e76
	https://git.kernel.org/stable/c/617e98ba4c50f4547c9eb0946b1cfc26937d70d1
	https://git.kernel.org/stable/c/413a01886c3958d4b8aac23a3bff3d430b92093e
	https://git.kernel.org/stable/c/b822644fd90992ee362c5e0c8d2556efc8856c76
	https://git.kernel.org/stable/c/0ae8ff7b6d42e33943af462910bdcfa2ec0cb8cf
	https://git.kernel.org/stable/c/b3fd51f684a0711504f82de510da109ae639722d
	https://git.kernel.org/stable/c/8ca3f7a7b61393804c46f170743c3b839df13977