CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-27010 – net/sched: Fix mirred deadlock on device recursion
https://notcve.org/view.php?id=CVE-2024-27010
In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix mirred deadlock on device recursion When the mirred action is used on a classful egress qdisc and a packet is mirrored or redirected to self we hit a qdisc lock deadlock. See trace below. [..... other info removed for brevity....] [ 82.890906] [ 82.890906] ============================================ [ 82.890906] WARNING: possible recursive locking detected [ 82.890906] 6.8.0-05205-g77fadd89fe2d-dirty #213 Tainted: G W [ 82.890906] -------------------------------------------- [ 82.890906] ping/418 is trying to acquire lock: [ 82.890906] ffff888006994110 (&sch->q.lock){+.-.}-{3:3}, at: __dev_queue_xmit+0x1778/0x3550 [ 82.890906] [ 82.890906] but task is already holding lock: [ 82.890906] ffff888006994110 (&sch->q.lock){+.-.}-{3:3}, at: __dev_queue_xmit+0x1778/0x3550 [ 82.890906] [ 82.890906] other info that might help us debug this: [ 82.890906] Possible unsafe locking scenario: [ 82.890906] [ 82.890906] CPU0 [ 82.890906] ---- [ 82.890906] lock(&sch->q.lock); [ 82.890906] lock(&sch->q.lock); [ 82.890906] [ 82.890906] *** DEADLOCK *** [ 82.890906] [..... other info removed for brevity....] Example setup (eth0->eth0) to recreate tc qdisc add dev eth0 root handle 1: htb default 30 tc filter add dev eth0 handle 1: protocol ip prio 2 matchall \ action mirred egress redirect dev eth0 Another example(eth0->eth1->eth0) to recreate tc qdisc add dev eth0 root handle 1: htb default 30 tc filter add dev eth0 handle 1: protocol ip prio 2 matchall \ action mirred egress redirect dev eth1 tc qdisc add dev eth1 root handle 1: htb default 30 tc filter add dev eth1 handle 1: protocol ip prio 2 matchall \ action mirred egress redirect dev eth0 We fix this by adding an owner field (CPU id) to struct Qdisc set after root qdisc is entered. When the softirq enters it a second time, if the qdisc owner is the same CPU, the packet is dropped to break the loop. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: net/sched: corrige el punto muerto reflejado en la recursividad del dispositivo Cuando la acción reflejada se utiliza en una qdisc de salida con clase y un paquete se refleja o redirige a uno mismo, llegamos a un punto muerto de bloqueo de qdisc. Vea el rastro a continuación. [..... otra información eliminada por brevedad....] [ 82.890906] [ 82.890906] ============================= ================ [82.890906] ADVERTENCIA: posible bloqueo recursivo detectado [82.890906] 6.8.0-05205-g77fadd89fe2d-dirty #213 Contaminado: GW [82.890906] ----- --------------------------------------- [ 82.890906] ping/418 está intentando adquirir el bloqueo : [ 82.890906] ffff888006994110 (&sch->q.lock){+.-.}-{3:3}, en: __dev_queue_xmit+0x1778/0x3550 [ 82.890906] [ 82.890906] pero la tarea ya mantiene el bloqueo: [ 82.890906] 88006994110 (&sch->q.lock){+.-.}-{3:3}, en: __dev_queue_xmit+0x1778/0x3550 [ 82.890906] [ 82.890906] otra información que podría ayudarnos a depurar esto: [ 82.890906] Posible escenario de bloqueo inseguro : [ 82.890906] [ 82.890906] CPU0 [ 82.890906] ---- [ 82.890906] bloqueo(&sch->q.lock); [ 82.890906] bloqueo(&sch->q.lock); [ 82.890906] [ 82.890906] *** DEADLOCK *** [ 82.890906] [..... otra información eliminada por brevedad....] Ejemplo de configuración (eth0->eth0) para recrear tc qdisc agregar dev eth0 identificador raíz 1 : htb default 30 tc filter add dev eth0 handle 1: protocolo ip prio 2 matchall \ action mirred egress redirigir dev eth0 Otro ejemplo (eth0->eth1->eth0) para recrear tc qdisc add dev eth0 root handle 1: htb default 30 tc filtro agregar dev eth0 identificador 1: protocolo ip prio 2 matchall \ acción redirección de salida reflejada dev eth1 tc qdisc agregar dev eth1 identificador raíz 1: htb predeterminado 30 tc filtro agregar dev eth1 identificador 1: protocolo ip prio 2 matchall \ acción duplicada redirección de salida dev eth0 Solucionamos esto agregando un campo de propietario (ID de CPU) a la estructura Qdisc establecida después de ingresar la qdisc raíz. • https://git.kernel.org/stable/c/e578d9c02587d57bfa7b560767c698a668a468c6 https://git.kernel.org/stable/c/e6b90468da4dae2281a6e381107f411efb48b0ef https://git.kernel.org/stable/c/0f022d32c3eca477fbf79a205243a6123ed0fe11 https://access.redhat.com/security/cve/CVE-2024-27010 https://bugzilla.redhat.com/show_bug.cgi?id=2278279 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2024-27009 – s390/cio: fix race condition during online processing
https://notcve.org/view.php?id=CVE-2024-27009
In the Linux kernel, the following vulnerability has been resolved: s390/cio: fix race condition during online processing A race condition exists in ccw_device_set_online() that can cause the online process to fail, leaving the affected device in an inconsistent state. As a result, subsequent attempts to set that device online fail with return code ENODEV. The problem occurs when a path verification request arrives after a wait for final device state completed, but before the result state is evaluated. Fix this by ensuring that the CCW-device lock is held between determining final state and checking result state. Note that since: commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") path verification requests are much more likely to occur during boot, resulting in an increased chance of this race condition occurring. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: s390/cio: corrige la condición de ejecución durante el procesamiento en línea Existe una condición de ejecución en ccw_device_set_online() que puede causar que el proceso en línea falle, dejando el dispositivo afectado en un estado inconsistente. Como resultado, los intentos posteriores de configurar ese dispositivo en línea fallan con el código de retorno ENODEV. El problema se produce cuando llega una solicitud de verificación de ruta después de que se complete la espera hasta que se complete el estado final del dispositivo, pero antes de que se evalúe el estado del resultado. • https://git.kernel.org/stable/c/2297791c92d04a154ad29ba5a073f9f627982110 https://git.kernel.org/stable/c/3076b3c38a704e10df5e143c213653309d532538 https://git.kernel.org/stable/c/559f3a6333397ab6cd4a696edd65a70b6be62c6e https://git.kernel.org/stable/c/2df56f4ea769ff81e51bbb05699989603bde9c49 https://git.kernel.org/stable/c/a4234decd0fe429832ca81c4637be7248b88b49e https://git.kernel.org/stable/c/2d8527f2f911fab84aec04df4788c0c23af3df48 •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2024-27008 – drm: nv04: Fix out of bounds access
https://notcve.org/view.php?id=CVE-2024-27008
In the Linux kernel, the following vulnerability has been resolved: drm: nv04: Fix out of bounds access When Output Resource (dcb->or) value is assigned in fabricate_dcb_output(), there may be out of bounds access to dac_users array in case dcb->or is zero because ffs(dcb->or) is used as index there. The 'or' argument of fabricate_dcb_output() must be interpreted as a number of bit to set, not value. Utilize macros from 'enum nouveau_or' in calls instead of hardcoding. Found by Linux Verification Center (linuxtesting.org) with SVACE. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: drm: nv04: corregir el acceso fuera de los límites Cuando se asigna el valor del recurso de salida (dcb->or) en fabricate_dcb_output(), puede haber acceso fuera de los límites a la matriz dac_users en caso de que dcb->or es cero porque ffs(dcb->or) se usa como índice allí. El argumento 'o' de fabricate_dcb_output() debe interpretarse como un número de bits a configurar, no como un valor. Utilice macros de 'enum nouveau_or' en las llamadas en lugar de codificarlas. Encontrado por el Centro de verificación de Linux (linuxtesting.org) con SVACE. • https://git.kernel.org/stable/c/2e5702aff39532662198459726c624d5eadbdd78 https://git.kernel.org/stable/c/c2b97f26f081ceec3298151481687071075a25cb https://git.kernel.org/stable/c/5050ae879a828d752b439e3827aac126709da6d1 https://git.kernel.org/stable/c/097c7918fcfa1dee233acfd1f3029f00c3bc8062 https://git.kernel.org/stable/c/df0991da7db846f7fa4ec6740350f743d3b69b04 https://git.kernel.org/stable/c/5fd4b090304e450aa0e7cc9cc2b4873285c6face https://git.kernel.org/stable/c/6690cc2732e2a8d0eaca44dcbac032a4b0148042 https://git.kernel.org/stable/c/26212da39ee14a52c76a202c6ae5153a8 •
CVSS: -EPSS: 0%CPEs: 2EXPL: 0CVE-2024-27007 – userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE
https://notcve.org/view.php?id=CVE-2024-27007
In the Linux kernel, the following vulnerability has been resolved: userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE Commit d7a08838ab74 ("mm: userfaultfd: fix unexpected change to src_folio when UFFDIO_MOVE fails") moved the src_folio->{mapping, index} changing to after clearing the page-table and ensuring that it's not pinned. This avoids failure of swapout+migration and possibly memory corruption. However, the commit missed fixing it in the huge-page case. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: userfaultfd: cambie src_folio después de asegurarse de que no esté fijado en UFFDIO_MOVE Commit d7a08838ab74 ("mm: userfaultfd: corrija el cambio inesperado en src_folio cuando UFFDIO_MOVE falla") movió src_folio->{mapping, index} cambiando a después de borrar la tabla de páginas y asegurarse de que no esté fijada. Esto evita fallos en el intercambio+migración y posiblemente daños en la memoria. Sin embargo, la confirmación no solucionó el problema en el caso de la página enorme. • https://git.kernel.org/stable/c/adef440691bab824e39c1b17382322d195e1fab0 https://git.kernel.org/stable/c/df5f6e683e7f21a15d8be6e7a0c7a46436963ebe https://git.kernel.org/stable/c/c0205eaf3af9f5db14d4b5ee4abacf4a583c3c50 •
CVSS: -EPSS: 0%CPEs: 2EXPL: 0CVE-2024-27006 – thermal/debugfs: Add missing count increment to thermal_debug_tz_trip_up()
https://notcve.org/view.php?id=CVE-2024-27006
In the Linux kernel, the following vulnerability has been resolved: thermal/debugfs: Add missing count increment to thermal_debug_tz_trip_up() The count field in struct trip_stats, representing the number of times the zone temperature was above the trip point, needs to be incremented in thermal_debug_tz_trip_up(), for two reasons. First, if a trip point is crossed on the way up for the first time, thermal_debug_update_temp() called from update_temperature() does not see it because it has not been added to trips_crossed[] array in the thermal zone's struct tz_debugfs object yet. Therefore, when thermal_debug_tz_trip_up() is called after that, the trip point's count value is 0, and the attempt to divide by it during the average temperature computation leads to a divide error which causes the kernel to crash. Setting the count to 1 before the division by incrementing it fixes this problem. Second, if a trip point is crossed on the way up, but it has been crossed on the way up already before, its count value needs to be incremented to make a record of the fact that the zone temperature is above the trip now. Without doing that, if the mitigations applied after crossing the trip cause the zone temperature to drop below its threshold, the count will not be updated for this episode at all and the average temperature in the trip statistics record will be somewhat higher than it should be. Cc :6.8+ <stable@vger.kernel.org> # 6.8+ En el kernel de Linux, se resolvió la siguiente vulnerabilidad: Thermal/debugfs: agregue el incremento de conteo faltante a Thermal_debug_tz_trip_up() El campo de conteo en la estructura trip_stats, que representa la cantidad de veces que la temperatura de la zona estuvo por encima del punto de disparo, debe incrementarse en Thermal_debug_tz_trip_up(), por dos razones. Primero, si se cruza un punto de viaje en el camino hacia arriba por primera vez, Thermal_debug_update_temp() llamado desde update_temperature() no lo ve porque aún no se ha agregado a la matriz trips_crossed[] en el objeto struct tz_debugfs de la zona térmica. • https://git.kernel.org/stable/c/7ef01f228c9f54c6260319858be138a8a7e9e704 https://git.kernel.org/stable/c/9c8215d32e730b597c809a9d2090bf8ec1b79fcf https://git.kernel.org/stable/c/b552f63cd43735048bbe9bfbb7a9dcfce166fbdd •