CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2023-52780 – net: mvneta: fix calls to page_pool_get_stats
https://notcve.org/view.php?id=CVE-2023-52780
In the Linux kernel, the following vulnerability has been resolved: net: mvneta: fix calls to page_pool_get_stats Calling page_pool_get_stats in the mvneta driver without checks leads to kernel crashes. First the page pool is only available if the bm is not used. The page pool is also not allocated when the port is stopped. It can also be not allocated in case of errors. The current implementation leads to the following crash calling ethstats on a port that is down or when calling it at the wrong moment: ble to handle kernel NULL pointer dereference at virtual address 00000070 [00000070] *pgd=00000000 Internal error: Oops: 5 [#1] SMP ARM Hardware name: Marvell Armada 380/385 (Device Tree) PC is at page_pool_get_stats+0x18/0x1cc LR is at mvneta_ethtool_get_stats+0xa0/0xe0 [mvneta] pc : [<c0b413cc>] lr : [<bf0a98d8>] psr: a0000013 sp : f1439d48 ip : f1439dc0 fp : 0000001d r10: 00000100 r9 : c4816b80 r8 : f0d75150 r7 : bf0b400c r6 : c238f000 r5 : 00000000 r4 : f1439d68 r3 : c2091040 r2 : ffffffd8 r1 : f1439d68 r0 : 00000000 Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 066b004a DAC: 00000051 Register r0 information: NULL pointer Register r1 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 Register r2 information: non-paged memory Register r3 information: slab kmalloc-2k start c2091000 pointer offset 64 size 2048 Register r4 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 Register r5 information: NULL pointer Register r6 information: slab kmalloc-cg-4k start c238f000 pointer offset 0 size 4096 Register r7 information: 15-page vmalloc region starting at 0xbf0a8000 allocated at load_module+0xa30/0x219c Register r8 information: 1-page vmalloc region starting at 0xf0d75000 allocated at ethtool_get_stats+0x138/0x208 Register r9 information: slab task_struct start c4816b80 pointer offset 0 Register r10 information: non-paged memory Register r11 information: non-paged memory Register r12 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 Process snmpd (pid: 733, stack limit = 0x38de3a88) Stack: (0xf1439d48 to 0xf143a000) 9d40: 000000c0 00000001 c238f000 bf0b400c f0d75150 c4816b80 9d60: 00000100 bf0a98d8 00000000 00000000 00000000 00000000 00000000 00000000 9d80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9da0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9dc0: 00000dc0 5335509c 00000035 c238f000 bf0b2214 01067f50 f0d75000 c0b9b9c8 9de0: 0000001d 00000035 c2212094 5335509c c4816b80 c238f000 c5ad6e00 01067f50 9e00: c1b0be80 c4816b80 00014813 c0b9d7f0 00000000 00000000 0000001d 0000001d 9e20: 00000000 00001200 00000000 00000000 c216ed90 c73943b8 00000000 00000000 9e40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9e60: 00000000 c0ad9034 00000000 00000000 00000000 00000000 00000000 00000000 9e80: 00000000 00000000 00000000 5335509c c1b0be80 f1439ee4 00008946 c1b0be80 9ea0: 01067f50 f1439ee3 00000000 00000046 b6d77ae0 c0b383f0 00008946 becc83e8 9ec0: c1b0be80 00000051 0000000b c68ca480 c7172d00 c0ad8ff0 f1439ee3 cf600e40 9ee0: 01600e40 32687465 00000000 00000000 00000000 01067f50 00000000 00000000 9f00: 00000000 5335509c 00008946 00008946 00000000 c68ca480 becc83e8 c05e2de0 9f20: f1439fb0 c03002f0 00000006 5ac3c35a c4816b80 00000006 b6d77ae0 c030caf0 9f40: c4817350 00000014 f1439e1c 0000000c 00000000 00000051 01000000 00000014 9f60: 00003fec f1439edc 00000001 c0372abc b6d77ae0 c0372abc cf600e40 5335509c 9f80: c21e6800 01015c9c 0000000b 00008946 00000036 c03002f0 c4816b80 00000036 9fa0: b6d77ae0 c03000c0 01015c9c 0000000b 0000000b 00008946 becc83e8 00000000 9fc0: 01015c9c 0000000b 00008946 00000036 00000035 010678a0 b6d797ec b6d77ae0 9fe0: b6dbf738 becc838c b6d186d7 b6baa858 40000030 0000000b 00000000 00000000 page_pool_get_s ---truncated--- En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: mvneta: corrige llamadas a page_pool_get_stats. Llamar a page_pool_get_stats en el controlador mvneta sin comprobaciones provoca fallos del kernel. Primero, el grupo de páginas solo está disponible si no se utiliza bm. El grupo de páginas tampoco se asigna cuando se detiene el puerto. También se puede no asignar en caso de errores. • https://git.kernel.org/stable/c/b3fc79225f055af7ef48b47a90752c31cc062e6e https://git.kernel.org/stable/c/00768b3e90e648227eaa959d9d279f5e32823df1 https://git.kernel.org/stable/c/230dc06e2495487d88b3410da055bb618febb19b https://git.kernel.org/stable/c/2b0e99072654edd601d05c0061a20337af5008ba https://git.kernel.org/stable/c/ca8add922f9c7f6e2e3c71039da8e0dcc64b87ed •
CVSS: -EPSS: 0%CPEs: 2EXPL: 0CVE-2023-52779 – fs: Pass AT_GETATTR_NOSEC flag to getattr interface function
https://notcve.org/view.php?id=CVE-2023-52779
In the Linux kernel, the following vulnerability has been resolved: fs: Pass AT_GETATTR_NOSEC flag to getattr interface function When vfs_getattr_nosec() calls a filesystem's getattr interface function then the 'nosec' should propagate into this function so that vfs_getattr_nosec() can again be called from the filesystem's gettattr rather than vfs_getattr(). The latter would add unnecessary security checks that the initial vfs_getattr_nosec() call wanted to avoid. Therefore, introduce the getattr flag GETATTR_NOSEC and allow to pass with the new getattr_flags parameter to the getattr interface function. In overlayfs and ecryptfs use this flag to determine which one of the two functions to call. In a recent code change introduced to IMA vfs_getattr_nosec() ended up calling vfs_getattr() in overlayfs, which in turn called security_inode_getattr() on an exiting process that did not have current->fs set anymore, which then caused a kernel NULL pointer dereference. With this change the call to security_inode_getattr() can be avoided, thus avoiding the NULL pointer dereference. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs: pasar el indicador AT_GETATTR_NOSEC a la función de interfaz getattr. Cuando vfs_getattr_nosec() llama a la función de interfaz getattr de un sistema de archivos, entonces 'nosec' debe propagarse a esta función para que se pueda volver a llamar a vfs_getattr_nosec() desde gettattr del sistema de archivos en lugar de vfs_getattr(). • https://git.kernel.org/stable/c/db1d1e8b9867aae5c3e61ad7859abfcc4a6fd6c7 https://git.kernel.org/stable/c/3fb0fa08641903304b9d81d52a379ff031dc41d4 https://git.kernel.org/stable/c/8a924db2d7b5eb69ba08b1a0af46e9f1359a9bdf •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2023-52778 – mptcp: deal with large GSO size
https://notcve.org/view.php?id=CVE-2023-52778
In the Linux kernel, the following vulnerability has been resolved: mptcp: deal with large GSO size After the blamed commit below, the TCP sockets (and the MPTCP subflows) can build egress packets larger than 64K. That exceeds the maximum DSS data size, the length being misrepresent on the wire and the stream being corrupted, as later observed on the receiver: WARNING: CPU: 0 PID: 9696 at net/mptcp/protocol.c:705 __mptcp_move_skbs_from_subflow+0x2604/0x26e0 CPU: 0 PID: 9696 Comm: syz-executor.7 Not tainted 6.6.0-rc5-gcd8bdf563d46 #45 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. RIP: 0010:__mptcp_move_skbs_from_subflow+0x2604/0x26e0 net/mptcp/protocol.c:705 RSP: 0018:ffffc90000006e80 EFLAGS: 00010246 RAX: ffffffff83e9f674 RBX: ffff88802f45d870 RCX: ffff888102ad0000 netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. RDX: 0000000080000303 RSI: 0000000000013908 RDI: 0000000000003908 RBP: ffffc90000007110 R08: ffffffff83e9e078 R09: 1ffff1100e548c8a R10: dffffc0000000000 R11: ffffed100e548c8b R12: 0000000000013908 R13: dffffc0000000000 R14: 0000000000003908 R15: 000000000031cf29 FS: 00007f239c47e700(0000) GS:ffff88811b200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f239c45cd78 CR3: 000000006a66c006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 PKRU: 55555554 Call Trace: <IRQ> mptcp_data_ready+0x263/0xac0 net/mptcp/protocol.c:819 subflow_data_ready+0x268/0x6d0 net/mptcp/subflow.c:1409 tcp_data_queue+0x21a1/0x7a60 net/ipv4/tcp_input.c:5151 tcp_rcv_established+0x950/0x1d90 net/ipv4/tcp_input.c:6098 tcp_v6_do_rcv+0x554/0x12f0 net/ipv6/tcp_ipv6.c:1483 tcp_v6_rcv+0x2e26/0x3810 net/ipv6/tcp_ipv6.c:1749 ip6_protocol_deliver_rcu+0xd6b/0x1ae0 net/ipv6/ip6_input.c:438 ip6_input+0x1c5/0x470 net/ipv6/ip6_input.c:483 ipv6_rcv+0xef/0x2c0 include/linux/netfilter.h:304 __netif_receive_skb+0x1ea/0x6a0 net/core/dev.c:5532 process_backlog+0x353/0x660 net/core/dev.c:5974 __napi_poll+0xc6/0x5a0 net/core/dev.c:6536 net_rx_action+0x6a0/0xfd0 net/core/dev.c:6603 __do_softirq+0x184/0x524 kernel/softirq.c:553 do_softirq+0xdd/0x130 kernel/softirq.c:454 Address the issue explicitly bounding the maximum GSO size to what MPTCP actually allows. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: mptcp: trata con un tamaño GSO grande. Después del compromiso culpable a continuación, los sockets TCP (y los subflujos MPTCP) pueden generar paquetes de salida de más de 64 KB. Eso excede el tamaño máximo de datos DSS, la longitud se tergiversa en el cable y la transmisión se corrompe, como se observó más tarde en el receptor: ADVERTENCIA: CPU: 0 PID: 9696 en net/mptcp/protocol.c:705 __mptcp_move_skbs_from_subflow+0x2604/ 0x26e0 CPU: 0 PID: 9696 Comm: syz-executor.7 No contaminado 6.6.0-rc5-gcd8bdf563d46 #45 Nombre del hardware: PC estándar QEMU (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01 /2014 netlink: 8 bytes sobrantes después de analizar los atributos en el proceso `syz-executor.4'. • https://git.kernel.org/stable/c/7c4e983c4f3cf94fcd879730c6caa877e0768a4d https://git.kernel.org/stable/c/70ff9b65a72885b3a2dfde6709da1f19b85fa696 https://git.kernel.org/stable/c/342b528c0e849bed9def76dadaa470d3af678e94 https://git.kernel.org/stable/c/57ced2eb77343a91d28f4a73675b05fe7b555def https://git.kernel.org/stable/c/9fce92f050f448a0d1ddd9083ef967d9930f1e52 •
CVSS: 5.2EPSS: 0%CPEs: 4EXPL: 0CVE-2023-52777 – wifi: ath11k: fix gtk offload status event locking
https://notcve.org/view.php?id=CVE-2023-52777
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix gtk offload status event locking The ath11k active pdevs are protected by RCU but the gtk offload status event handling code calling ath11k_mac_get_arvif_by_vdev_id() was not marked as a read-side critical section. Mark the code in question as an RCU read-side critical section to avoid any potential use-after-free issues. Compile tested only. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: wifi: ath11k: corrige el bloqueo de eventos de estado de descarga de gtk. Los pdevs activos de ath11k están protegidos por RCU, pero el código de manejo de eventos de estado de descarga de gtk que llama a ath11k_mac_get_arvif_by_vdev_id() no se marcó como lado de lectura sección crítica. Marque el código en cuestión como una sección crítica del lado de lectura de RCU para evitar posibles problemas de use after free. Compilación probada únicamente. • https://git.kernel.org/stable/c/a16d9b50cfbaf112401b8e5ccfa852709f498cd4 https://git.kernel.org/stable/c/0cf7577b6b3153b4b49deea9719fe43f96469c6d https://git.kernel.org/stable/c/cf9c7d783a2bf9305df4ef5b93d9063a52e18fca https://git.kernel.org/stable/c/e83246ecd3b193f8d91fce778e8a5ba747fc7d8a https://git.kernel.org/stable/c/1dea3c0720a146bd7193969f2847ccfed5be2221 https://access.redhat.com/security/cve/CVE-2023-52777 https://bugzilla.redhat.com/show_bug.cgi?id=2282642 • CWE-416: Use After Free •
CVSS: 5.9EPSS: 0%CPEs: 3EXPL: 0CVE-2023-52776 – wifi: ath12k: fix dfs-radar and temperature event locking
https://notcve.org/view.php?id=CVE-2023-52776
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dfs-radar and temperature event locking The ath12k active pdevs are protected by RCU but the DFS-radar and temperature event handling code calling ath12k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section. Mark the code in question as RCU read-side critical sections to avoid any potential use-after-free issues. Note that the temperature event handler looks like a place holder currently but would still trigger an RCU lockdep splat. Compile tested only. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath12k: corrige el bloqueo de eventos de temperatura y radar dfs. Los pdev activos de ath12k están protegidos por RCU, pero el código de manejo de eventos de temperatura y radar DFS que llama a ath12k_mac_get_ar_by_pdev_id() no estaba marcado como una sección crítica del lado de lectura. Marque el código en cuestión como secciones críticas del lado de lectura de RCU para evitar posibles problemas de use after free. Tenga en cuenta que el controlador de eventos de temperatura actualmente parece un marcador de posición, pero aún así activaría un bloqueo de bloqueo de RCU. • https://git.kernel.org/stable/c/d889913205cf7ebda905b1e62c5867ed4e39f6c2 https://git.kernel.org/stable/c/774de37c147fea81f2c2e4be5082304f4f71d535 https://git.kernel.org/stable/c/d7a5f7f76568e48869916d769e28b9f3ca70c78e https://git.kernel.org/stable/c/69bd216e049349886405b1c87a55dce3d35d1ba7 •