linux-cve-announce - CVE-2024-36952: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024053040-CVE-2024-36952-f8f8@gregkh>
Date: Thu, 30 May 2024 17:35:49 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-36952: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Move NPIV's transport unregistration to after resource clean up

There are cases after NPIV deletion where the fabric switch still believes
the NPIV is logged into the fabric.  This occurs when a vport is
unregistered before the Remove All DA_ID CT and LOGO ELS are sent to the
fabric.

Currently fc_remove_host(), which calls dev_loss_tmo for all D_IDs including
the fabric D_ID, removes the last ndlp reference and frees the ndlp rport
object.  This sometimes causes the race condition where the final DA_ID and
LOGO are skipped from being sent to the fabric switch.

Fix by moving the fc_remove_host() and scsi_remove_host() calls after DA_ID
and LOGO are sent.

The Linux kernel CVE team has assigned CVE-2024-36952 to this issue.

Affected and fixed versions
===========================

	Fixed in 5.15.159 with commit f2c7f029051e
	Fixed in 6.1.91 with commit 0936809d968e
	Fixed in 6.6.31 with commit 76337eb8daee
	Fixed in 6.8.10 with commit 718602cd15f4
	Fixed in 6.9 with commit 4ddf01f2f150

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-36952
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/scsi/lpfc/lpfc_vport.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f2c7f029051edc4b394bb48edbe2297575abefe0
	https://git.kernel.org/stable/c/0936809d968ecf81e0726fbd02ff2a5732d960c3
	https://git.kernel.org/stable/c/76337eb8daee32bcc67742efab3168ed4ca299d0
	https://git.kernel.org/stable/c/718602cd15f4c5710850090ea3066a89eeb46278
	https://git.kernel.org/stable/c/4ddf01f2f1504fa08b766e8cfeec558e9f8eef6c