| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024061955-CVE-2024-38593-8b0e@gregkh> Date: Wed, 19 Jun 2024 15:45:59 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-38593: net: micrel: Fix receiving the timestamp in the frame for lan8841 Description =========== In the Linux kernel, the following vulnerability has been resolved: net: micrel: Fix receiving the timestamp in the frame for lan8841 The blamed commit started to use the ptp workqueue to get the second part of the timestamp. And when the port was set down, then this workqueue is stopped. But if the config option NETWORK_PHY_TIMESTAMPING is not enabled, then the ptp_clock is not initialized so then it would crash when it would try to access the delayed work. So then basically by setting up and then down the port, it would crash. The fix consists in checking if the ptp_clock is initialized and only then cancel the delayed work. The Linux kernel CVE team has assigned CVE-2024-38593 to this issue. Affected and fixed versions =========================== Issue introduced in 6.5 with commit cc7554954848 and fixed in 6.6.33 with commit 3ddf170e4a60 Issue introduced in 6.5 with commit cc7554954848 and fixed in 6.8.12 with commit 3fd4282d5f25 Issue introduced in 6.5 with commit cc7554954848 and fixed in 6.9.3 with commit 64a47cf634ae Issue introduced in 6.5 with commit cc7554954848 and fixed in 6.10-rc1 with commit aea27a92a41d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-38593 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/phy/micrel.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3ddf170e4a604f5d4d9459a36993f5e92b53e8b0 https://git.kernel.org/stable/c/3fd4282d5f25c3c97fef3ef0b89b82ef4e2bc975 https://git.kernel.org/stable/c/64a47cf634ae44e92be24ebc982410841093bd7b https://git.kernel.org/stable/c/aea27a92a41dae14843f92c79e9e42d8f570105c
Powered by blists - more mailing lists