| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025022616-CVE-2022-49626-e785@gregkh> Date: Wed, 26 Feb 2025 03:23:09 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2022-49626: sfc: fix use after free when disabling sriov Description =========== In the Linux kernel, the following vulnerability has been resolved: sfc: fix use after free when disabling sriov Use after free is detected by kfence when disabling sriov. What was read after being freed was vf->pci_dev: it was freed from pci_disable_sriov and later read in efx_ef10_sriov_free_vf_vports, called from efx_ef10_sriov_free_vf_vswitching. Set the pointer to NULL at release time to not trying to read it later. Reproducer and dmesg log (note that kfence doesn't detect it every time): $ echo 1 > /sys/class/net/enp65s0f0np0/device/sriov_numvfs $ echo 0 > /sys/class/net/enp65s0f0np0/device/sriov_numvfs BUG: KFENCE: use-after-free read in efx_ef10_sriov_free_vf_vswitching+0x82/0x170 [sfc] Use-after-free read at 0x00000000ff3c1ba5 (in kfence-#224): efx_ef10_sriov_free_vf_vswitching+0x82/0x170 [sfc] efx_ef10_pci_sriov_disable+0x38/0x70 [sfc] efx_pci_sriov_configure+0x24/0x40 [sfc] sriov_numvfs_store+0xfe/0x140 kernfs_fop_write_iter+0x11c/0x1b0 new_sync_write+0x11f/0x1b0 vfs_write+0x1eb/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x5c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae kfence-#224: 0x00000000edb8ef95-0x00000000671f5ce1, size=2792, cache=kmalloc-4k allocated by task 6771 on cpu 10 at 3137.860196s: pci_alloc_dev+0x21/0x60 pci_iov_add_virtfn+0x2a2/0x320 sriov_enable+0x212/0x3e0 efx_ef10_sriov_configure+0x67/0x80 [sfc] efx_pci_sriov_configure+0x24/0x40 [sfc] sriov_numvfs_store+0xba/0x140 kernfs_fop_write_iter+0x11c/0x1b0 new_sync_write+0x11f/0x1b0 vfs_write+0x1eb/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x5c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae freed by task 6771 on cpu 12 at 3170.991309s: device_release+0x34/0x90 kobject_cleanup+0x3a/0x130 pci_iov_remove_virtfn+0xd9/0x120 sriov_disable+0x30/0xe0 efx_ef10_pci_sriov_disable+0x57/0x70 [sfc] efx_pci_sriov_configure+0x24/0x40 [sfc] sriov_numvfs_store+0xfe/0x140 kernfs_fop_write_iter+0x11c/0x1b0 new_sync_write+0x11f/0x1b0 vfs_write+0x1eb/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x5c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae The Linux kernel CVE team has assigned CVE-2022-49626 to this issue. Affected and fixed versions =========================== Issue introduced in 4.2 with commit 3c5eb87605e85146a78de589b5070a37862425db and fixed in 4.9.324 with commit 3199e34912d84cdfb8a93a984c5ae5c73fb13e84 Issue introduced in 4.2 with commit 3c5eb87605e85146a78de589b5070a37862425db and fixed in 4.14.289 with commit c9e75bb22a26e391f189f5a5133dd63dcb57fdaa Issue introduced in 4.2 with commit 3c5eb87605e85146a78de589b5070a37862425db and fixed in 4.19.253 with commit 9c854ae512b89229aeee93849e9bd4c115b37909 Issue introduced in 4.2 with commit 3c5eb87605e85146a78de589b5070a37862425db and fixed in 5.4.207 with commit bcad880865bfb421885364b1f0c7351280fe2b97 Issue introduced in 4.2 with commit 3c5eb87605e85146a78de589b5070a37862425db and fixed in 5.10.132 with commit c2240500817b3b4b996cdf2a461a3a5679f49b94 Issue introduced in 4.2 with commit 3c5eb87605e85146a78de589b5070a37862425db and fixed in 5.15.56 with commit 58d93e9d160c0de6d867c7eb4c2206671a351eb1 Issue introduced in 4.2 with commit 3c5eb87605e85146a78de589b5070a37862425db and fixed in 5.18.13 with commit e435c4aeeaa073091f7f3b7735af2ef5c97d63f2 Issue introduced in 4.2 with commit 3c5eb87605e85146a78de589b5070a37862425db and fixed in 5.19 with commit ebe41da5d47ac0fff877e57bd14c54dccf168827 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49626 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/ethernet/sfc/ef10_sriov.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3199e34912d84cdfb8a93a984c5ae5c73fb13e84 https://git.kernel.org/stable/c/c9e75bb22a26e391f189f5a5133dd63dcb57fdaa https://git.kernel.org/stable/c/9c854ae512b89229aeee93849e9bd4c115b37909 https://git.kernel.org/stable/c/bcad880865bfb421885364b1f0c7351280fe2b97 https://git.kernel.org/stable/c/c2240500817b3b4b996cdf2a461a3a5679f49b94 https://git.kernel.org/stable/c/58d93e9d160c0de6d867c7eb4c2206671a351eb1 https://git.kernel.org/stable/c/e435c4aeeaa073091f7f3b7735af2ef5c97d63f2 https://git.kernel.org/stable/c/ebe41da5d47ac0fff877e57bd14c54dccf168827
Powered by blists - more mailing lists