| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024052238-CVE-2021-47482-5612@gregkh> Date: Wed, 22 May 2024 10:19:42 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2021-47482: net: batman-adv: fix error handling Description =========== In the Linux kernel, the following vulnerability has been resolved: net: batman-adv: fix error handling Syzbot reported ODEBUG warning in batadv_nc_mesh_free(). The problem was in wrong error handling in batadv_mesh_init(). Before this patch batadv_mesh_init() was calling batadv_mesh_free() in case of any batadv_*_init() calls failure. This approach may work well, when there is some kind of indicator, which can tell which parts of batadv are initialized; but there isn't any. All written above lead to cleaning up uninitialized fields. Even if we hide ODEBUG warning by initializing bat_priv->nc.work, syzbot was able to hit GPF in batadv_nc_purge_paths(), because hash pointer in still NULL. [1] To fix these bugs we can unwind batadv_*_init() calls one by one. It is good approach for 2 reasons: 1) It fixes bugs on error handling path 2) It improves the performance, since we won't call unneeded batadv_*_free() functions. So, this patch makes all batadv_*_init() clean up all allocated memory before returning with an error to no call correspoing batadv_*_free() and open-codes batadv_mesh_free() with proper order to avoid touching uninitialized fields. The Linux kernel CVE team has assigned CVE-2021-47482 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.38 with commit c6c8fea29769 and fixed in 4.4.293 with commit 0c6b199f09be Issue introduced in 2.6.38 with commit c6c8fea29769 and fixed in 4.9.289 with commit 07533f1a673c Issue introduced in 2.6.38 with commit c6c8fea29769 and fixed in 4.14.254 with commit e50f95765219 Issue introduced in 2.6.38 with commit c6c8fea29769 and fixed in 4.19.215 with commit fbf150b16a36 Issue introduced in 2.6.38 with commit c6c8fea29769 and fixed in 5.4.157 with commit 6422e8471890 Issue introduced in 2.6.38 with commit c6c8fea29769 and fixed in 5.10.77 with commit b0a2cd38553c Issue introduced in 2.6.38 with commit c6c8fea29769 and fixed in 5.14.16 with commit a8f7359259dd Issue introduced in 2.6.38 with commit c6c8fea29769 and fixed in 5.15 with commit 6f68cd634856 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2021-47482 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/batman-adv/bridge_loop_avoidance.c net/batman-adv/main.c net/batman-adv/network-coding.c net/batman-adv/translation-table.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/0c6b199f09be489c48622537a550787fc80aea73 https://git.kernel.org/stable/c/07533f1a673ce1126d0a72ef1e4b5eaaa3dd6d20 https://git.kernel.org/stable/c/e50f957652190b5a88a8ebce7e5ab14ebd0d3f00 https://git.kernel.org/stable/c/fbf150b16a3635634b7dfb7f229d8fcd643c6c51 https://git.kernel.org/stable/c/6422e8471890273994fe8cc6d452b0dcd2c9483e https://git.kernel.org/stable/c/b0a2cd38553c77928ef1646ed1518486b1e70ae8 https://git.kernel.org/stable/c/a8f7359259dd5923adc6129284fdad12fc5db347 https://git.kernel.org/stable/c/6f68cd634856f8ca93bafd623ba5357e0f648c68
Powered by blists - more mailing lists