linux-cve-announce - CVE-2024-56638: netfilter: nft_inner: incorrect percpu area handling under softirq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024122735-CVE-2024-56638-3a3d@gregkh>
Date: Fri, 27 Dec 2024 16:02:39 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-56638: netfilter: nft_inner: incorrect percpu area handling under softirq

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_inner: incorrect percpu area handling under softirq

Softirq can interrupt ongoing packet from process context that is
walking over the percpu area that contains inner header offsets.

Disable bh and perform three checks before restoring the percpu inner
header offsets to validate that the percpu area is valid for this
skbuff:

1) If the NFT_PKTINFO_INNER_FULL flag is set on, then this skbuff
   has already been parsed before for inner header fetching to
   register.

2) Validate that the percpu area refers to this skbuff using the
   skbuff pointer as a cookie. If there is a cookie mismatch, then
   this skbuff needs to be parsed again.

3) Finally, validate if the percpu area refers to this tunnel type.

Only after these three checks the percpu area is restored to a on-stack
copy and bh is enabled again.

After inner header fetching, the on-stack copy is stored back to the
percpu area.

The Linux kernel CVE team has assigned CVE-2024-56638 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.2 with commit 3a07327d10a09379315c844c63f27941f5081e0a and fixed in 6.6.66 with commit 53c7314208c865086d78b4e88da53bc33da0b603
	Issue introduced in 6.2 with commit 3a07327d10a09379315c844c63f27941f5081e0a and fixed in 6.12.5 with commit da5cc778e7bf78fe525bc90ec2043f41415c31d9
	Issue introduced in 6.2 with commit 3a07327d10a09379315c844c63f27941f5081e0a and fixed in 6.13-rc2 with commit 7b1d83da254be3bf054965c8f3b1ad976f460ae5

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-56638
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/net/netfilter/nf_tables_core.h
	net/netfilter/nft_inner.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/53c7314208c865086d78b4e88da53bc33da0b603
	https://git.kernel.org/stable/c/da5cc778e7bf78fe525bc90ec2043f41415c31d9
	https://git.kernel.org/stable/c/7b1d83da254be3bf054965c8f3b1ad976f460ae5