linux-cve-announce - CVE-2024-42116: igc: fix a log entry using uninitialized netdev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024073023-CVE-2024-42116-b420@gregkh>
Date: Tue, 30 Jul 2024 09:47:34 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-42116: igc: fix a log entry using uninitialized netdev

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

igc: fix a log entry using uninitialized netdev

During successful probe, igc logs this:

[    5.133667] igc 0000:01:00.0 (unnamed net_device) (uninitialized): PHC added
                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The reason is that igc_ptp_init() is called very early, even before
register_netdev() has been called. So the netdev_info() call works
on a partially uninitialized netdev.

Fix this by calling igc_ptp_init() after register_netdev(), right
after the media autosense check, just as in igb.  Add a comment,
just as in igb.

Now the log message is fine:

[    5.200987] igc 0000:01:00.0 eth0: PHC added

The Linux kernel CVE team has assigned CVE-2024-42116 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.15.163 with commit 96839f3f5882
	Fixed in 6.1.98 with commit 98c8958980e8
	Fixed in 6.6.39 with commit 991f036cabc3
	Fixed in 6.9.9 with commit d478ec838cf2
	Fixed in 6.10 with commit 86167183a17e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-42116
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/intel/igc/igc_main.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/96839f3f588236593de36465f142b0126267f8b6
	https://git.kernel.org/stable/c/98c8958980e829f023a490b9a9816ca1fe2f8b79
	https://git.kernel.org/stable/c/991f036cabc3d13e886a37faeea1b6800181fdda
	https://git.kernel.org/stable/c/d478ec838cf2b1e1051a8709cfc744fe1c03110f
	https://git.kernel.org/stable/c/86167183a17e03ec77198897975e9fdfbd53cb0b