lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025011531-CVE-2024-36476-b2a1@gregkh> Date: Wed, 15 Jan 2025 14:10:32 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-36476: RDMA/rtrs: Ensure 'ib_sge list' is accessible Description =========== In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Ensure 'ib_sge list' is accessible Move the declaration of the 'ib_sge list' variable outside the 'always_invalidate' block to ensure it remains accessible for use throughout the function. Previously, 'ib_sge list' was declared within the 'always_invalidate' block, limiting its accessibility, then caused a 'BUG: kernel NULL pointer dereference'[1]. ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2d0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? memcpy_orig+0xd5/0x140 rxe_mr_copy+0x1c3/0x200 [rdma_rxe] ? rxe_pool_get_index+0x4b/0x80 [rdma_rxe] copy_data+0xa5/0x230 [rdma_rxe] rxe_requester+0xd9b/0xf70 [rdma_rxe] ? finish_task_switch.isra.0+0x99/0x2e0 rxe_sender+0x13/0x40 [rdma_rxe] do_task+0x68/0x1e0 [rdma_rxe] process_one_work+0x177/0x330 worker_thread+0x252/0x390 ? __pfx_worker_thread+0x10/0x10 This change ensures the variable is available for subsequent operations that require it. [1] https://lore.kernel.org/linux-rdma/6a1f3e8f-deb0-49f9-bc69-a9b03ecfcda7@fujitsu.com/ The Linux kernel CVE team has assigned CVE-2024-36476 to this issue. Affected and fixed versions =========================== Issue introduced in 5.8 with commit 9cb837480424e78ed585376f944088246685aec3 and fixed in 5.10.233 with commit 7eaa71f56a6f7ab87957213472dc6d4055862722 Issue introduced in 5.8 with commit 9cb837480424e78ed585376f944088246685aec3 and fixed in 5.15.176 with commit 143378075904e78b3b2a810099bcc3b3d82d762f Issue introduced in 5.8 with commit 9cb837480424e78ed585376f944088246685aec3 and fixed in 6.1.124 with commit 32e1e748a85bd52b20b3857d80fd166d22fa455a Issue introduced in 5.8 with commit 9cb837480424e78ed585376f944088246685aec3 and fixed in 6.6.70 with commit b238f61cc394d5fef27b26d7d9aa383ebfddabb0 Issue introduced in 5.8 with commit 9cb837480424e78ed585376f944088246685aec3 and fixed in 6.12.9 with commit 6ffb5c1885195ae5211a12b4acd2d51843ca41b0 Issue introduced in 5.8 with commit 9cb837480424e78ed585376f944088246685aec3 and fixed in 6.13-rc6 with commit fb514b31395946022f13a08e06a435f53cf9e8b3 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-36476 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/infiniband/ulp/rtrs/rtrs-srv.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/7eaa71f56a6f7ab87957213472dc6d4055862722 https://git.kernel.org/stable/c/143378075904e78b3b2a810099bcc3b3d82d762f https://git.kernel.org/stable/c/32e1e748a85bd52b20b3857d80fd166d22fa455a https://git.kernel.org/stable/c/b238f61cc394d5fef27b26d7d9aa383ebfddabb0 https://git.kernel.org/stable/c/6ffb5c1885195ae5211a12b4acd2d51843ca41b0 https://git.kernel.org/stable/c/fb514b31395946022f13a08e06a435f53cf9e8b3
Powered by blists - more mailing lists