| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024071251-CVE-2024-40995-2a5c@gregkh> Date: Fri, 12 Jul 2024 14:37:59 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-40995: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() Description =========== In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() syzbot found hanging tasks waiting on rtnl_lock [1] A reproducer is available in the syzbot bug. When a request to add multiple actions with the same index is sent, the second request will block forever on the first request. This holds rtnl_lock, and causes tasks to hang. Return -EAGAIN to prevent infinite looping, while keeping documented behavior. [1] INFO: task kworker/1:0:5088 blocked for more than 143 seconds. Not tainted 6.9.0-rc4-syzkaller-00173-g3cdb45594619 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:0 state:D stack:23744 pid:5088 tgid:5088 ppid:2 flags:0x00004000 Workqueue: events_power_efficient reg_check_chans_work Call Trace: <TASK> context_switch kernel/sched/core.c:5409 [inline] __schedule+0xf15/0x5d00 kernel/sched/core.c:6746 __schedule_loop kernel/sched/core.c:6823 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6838 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6895 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 wiphy_lock include/net/cfg80211.h:5953 [inline] reg_leave_invalid_chans net/wireless/reg.c:2466 [inline] reg_check_chans_work+0x10a/0x10e0 net/wireless/reg.c:2481 The Linux kernel CVE team has assigned CVE-2024-40995 to this issue. Affected and fixed versions =========================== Issue introduced in 4.19 with commit 0190c1d452a9 and fixed in 5.4.279 with commit 0d8a2d287c8a Issue introduced in 4.19 with commit 0190c1d452a9 and fixed in 5.10.221 with commit c6a7da65a296 Issue introduced in 4.19 with commit 0190c1d452a9 and fixed in 5.15.162 with commit 25987a97eec4 Issue introduced in 4.19 with commit 0190c1d452a9 and fixed in 6.1.96 with commit 6fc78d67f51a Issue introduced in 4.19 with commit 0190c1d452a9 and fixed in 6.6.36 with commit 5f926aa96b08 Issue introduced in 4.19 with commit 0190c1d452a9 and fixed in 6.9.7 with commit 7a0e497b597d Issue introduced in 4.19 with commit 0190c1d452a9 and fixed in 6.10-rc5 with commit d864319871b0 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-40995 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/sched/act_api.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/0d8a2d287c8a394c0d4653f0c6c7be4c688e5a74 https://git.kernel.org/stable/c/c6a7da65a296745535a964be1019ec7691b0cb90 https://git.kernel.org/stable/c/25987a97eec4d5f897cd04ee1b45170829c610da https://git.kernel.org/stable/c/6fc78d67f51aeb9a542d39a8714e16bc411582d4 https://git.kernel.org/stable/c/5f926aa96b08b6c47178fe1171e7ae331c695fc2 https://git.kernel.org/stable/c/7a0e497b597df7c4cf2b63fc6e9188b6cabe5335 https://git.kernel.org/stable/c/d864319871b05fadd153e0aede4811ca7008f5d6
Powered by blists - more mailing lists