CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2024-35886 – ipv6: Fix infinite recursion in fib6_dump_done().
https://notcve.org/view.php?id=CVE-2024-35886
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in fib6_dump_done(). syzkaller reported infinite recursive calls of fib6_dump_done() during netlink socket destruction... /include/linux/slab.h:628 ./include/linux/slab.h:749 net/ipv6/ip6_fib.c:662) rtnl_dump_all (net/core/rtnetlink.c:4029) netlink_dump (net/netlink/af_netlink.c:2269) netlink_recvmsg (net/netlink/af_netlink.c:1988) ____sys_recvmsg (net/socket.c:1046 net/socket.c:2801) ___sys_recvmsg (net/socket.c:2846) do_recvmmsg (net/socket.c:2943) __x64_sys_recvmmsg (net/socket.c:3041 net/socket.c:3034 net/socket.c:3034) [1]: BUG: TASK stack guard page was hit at 00000000f2fa9af1 (stack is 00000000b7912430..000000009a436beb) stack guard page: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 223719 Comm: kworker/1:3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: events netlink_sock_destruct_work RIP: 0010:fib6_dump_done (net/ipv6/ip6_fib.c:570) Code: 3c 24 e8 f3 e9 51 fd e9 28 fd ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 41 57 41 56 41 55 41 54 55 48 89 fd <53> 48 8d 5d 60 e8 b6 4d 07 fd 48 89 da 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffffc9000d980000 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffffffff84405990 RCX: ffffffff844059d3 RDX: ffff8881028e0000 RSI: ffffffff84405ac2 RDI: ffff88810c02f358 RBP: ffff88810c02f358 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000224 R12: 0000000000000000 R13: ffff888007c82c78 R14: ffff888007c82c68 R15: ffff888007c82c68 FS: 0000000000000000(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000d97fff8 CR3: 0000000102309002 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <#DF> </#DF> <TASK> fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) ... fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) netlink_sock_destruct (net/netlink/af_netlink.c:401) __sk_destruct (net/core/sock.c:2177 (discriminator 2)) sk_destruct (net/core/sock.c:2224) __sk_free (net/core/sock.c:2235) sk_free (net/core/sock.c:2246) process_one_work (kernel/workqueue.c:3259) worker_thread (kernel/workqueue.c:3329 kernel/workqueue. ---truncated--- En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: ipv6: Se corrigió la recursividad infinita en fib6_dump_done(). syzkaller informó infinitas llamadas recursivas de fib6_dump_done() durante la destrucción del socket netlink. [1] Desde el registro, syzkaller envió un mensaje AF_UNSPEC RTM_GETROUTE y luego se generó la respuesta. ... Para evitar el problema, configuremos el destructor después de kzalloc(). [0]: FAULT_INJECTION: forzando un fallo. nombre failslab, intervalo 1, probabilidad 0, espacio 0, tiempos 0 CPU: 1 PID: 432110 Comm: syz-executor.3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11 Nombre del hardware: PC estándar QEMU (i440FX + PIIX , 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 01/04/2014 Seguimiento de llamadas: dump_stack_lvl (lib/dump_stack.c:117) debería_fail_ex (lib/fault-inject.c :52 lib/fault-inject.c:153) must_failslab (mm/slub.c:3733) kmalloc_trace (mm/slub.c:3748 mm/slub.c:3827 mm/slub.c:3992) inet6_dump_fib (./ include/linux/slab.h:628 ./include/linux/slab.h:749 net/ipv6/ip6_fib.c:662) rtnl_dump_all (net/core/rtnetlink.c:4029) netlink_dump (net/netlink/af_netlink. c:2269) netlink_recvmsg (net/netlink/af_netlink.c:1988) ____sys_recvmsg (net/socket.c:1046 net/socket.c:2801) ___sys_recvmsg (net/socket.c:2846) do_recvmmsg (net/socket.c :2943) __x64_sys_recvmmsg (net/socket.c:3041 net/socket.c:3034 net/socket.c:3034) [1]: ERROR: La página de protección de la pila de TAREA fue visitada en 00000000f2fa9af1 (la pila es 00000000b7912430..000000009a436be b) pila página de protección: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 223719 Comm: kworker/1:3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11 Nombre de hardware: PC estándar QEMU (i440FX + PIIX, 1996) , BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 01/04/2014 Cola de trabajo: eventos netlink_sock_destruct_work RIP: 0010:fib6_dump_done (net/ipv6/ip6_fib.c:570) Código: 3c 24 e8 f3 e9 51 fd e9 28 fd ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 41 57 41 56 41 55 41 54 55 48 89 fd <53> 48 8d 5d 60 e8 b6 4d 07 fd 48 89 da 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffffc9000d980000 EFLAGS: 00010293 RAX: 00000000000000000 RBX: ffffffff84405990 RCX: ffffffff844059d3 RDX: 881028e0000 RSI: ffffffff84405ac2 RDI: ffff88810c02f358 RBP: ffff88810c02f358 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 0R11: 0000000000000224 R12: 0000000000000000 R13: ffff888007c82c78 R14: ffff888007c82c68 R15: ffff888007c82c68 FS: 0000000000000000(0000) ffff88811b100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000d97fff8 CR3: 0000000102309002 000000000770ef0 PKRU : 55555554 Seguimiento de llamadas: <#DF> fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminador 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminador 1)). .. fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminador 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminador 1)) netlink_sock_destruct (net/netlink/af_netlink.c:401) __sk_destruct (net/ core/sock.c:2177 (discriminador 2)) sk_destruct (net/core/sock.c:2224) __sk_free (net/core/sock.c:2235) sk_free (net/core/sock.c:2246) Process_one_work ( kernel/workqueue.c:3259)-truncado- • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 https://git.kernel.org/stable/c/9472d07cd095cbd3294ac54c42f304a38fbe9bfe https://git.kernel.org/stable/c/9c5258196182c25b55c33167cd72fdd9bbf08985 https://git.kernel.org/stable/c/fd307f2d91d40fa7bc55df3e2cd1253fabf8a2d6 https://git.kernel.org/stable/c/40a344b2ddc06c1a2caa7208a43911f39c662778 https://git.kernel.org/stable/c/167d4b47a9bdcb01541dfa29e9f3cbb8edd3dfd2 https://git.kernel.org/stable/c/f2dd75e57285f49e34af1a5b6cd8945c08243776 https://git.kernel.org/stable/c/4a7c465a5dcd657d59d25bf4815e19ac0 •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-35885 – mlxbf_gige: stop interface during shutdown
https://notcve.org/view.php?id=CVE-2024-35885
In the Linux kernel, the following vulnerability has been resolved: mlxbf_gige: stop interface during shutdown The mlxbf_gige driver intermittantly encounters a NULL pointer exception while the system is shutting down via "reboot" command. The mlxbf_driver will experience an exception right after executing its shutdown() method. One example of this exception is: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000070 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=000000011d373000 [0000000000000070] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 96000004 [#1] SMP CPU: 0 PID: 13 Comm: ksoftirqd/0 Tainted: G S OE 5.15.0-bf.6.gef6992a #1 Hardware name: https://www.mellanox.com BlueField SoC/BlueField SoC, BIOS 4.0.2.12669 Apr 21 2023 pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mlxbf_gige_handle_tx_complete+0xc8/0x170 [mlxbf_gige] lr : mlxbf_gige_poll+0x54/0x160 [mlxbf_gige] sp : ffff8000080d3c10 x29: ffff8000080d3c10 x28: ffffcce72cbb7000 x27: ffff8000080d3d58 x26: ffff0000814e7340 x25: ffff331cd1a05000 x24: ffffcce72c4ea008 x23: ffff0000814e4b40 x22: ffff0000814e4d10 x21: ffff0000814e4128 x20: 0000000000000000 x19: ffff0000814e4a80 x18: ffffffffffffffff x17: 000000000000001c x16: ffffcce72b4553f4 x15: ffff80008805b8a7 x14: 0000000000000000 x13: 0000000000000030 x12: 0101010101010101 x11: 7f7f7f7f7f7f7f7f x10: c2ac898b17576267 x9 : ffffcce720fa5404 x8 : ffff000080812138 x7 : 0000000000002e9a x6 : 0000000000000080 x5 : ffff00008de3b000 x4 : 0000000000000000 x3 : 0000000000000001 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: mlxbf_gige_handle_tx_complete+0xc8/0x170 [mlxbf_gige] mlxbf_gige_poll+0x54/0x160 [mlxbf_gige] __napi_poll+0x40/0x1c8 net_rx_action+0x314/0x3a0 __do_softirq+0x128/0x334 run_ksoftirqd+0x54/0x6c smpboot_thread_fn+0x14c/0x190 kthread+0x10c/0x110 ret_from_fork+0x10/0x20 Code: 8b070000 f9000ea0 f95056c0 f86178a1 (b9407002) ---[ end trace 7cc3941aa0d8e6a4 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt Kernel Offset: 0x4ce722520000 from 0xffff800008000000 PHYS_OFFSET: 0x80000000 CPU features: 0x000005c1,a3330e5a Memory Limit: none ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- During system shutdown, the mlxbf_gige driver's shutdown() is always executed. However, the driver's stop() method will only execute if networking interface configuration logic within the Linux distribution has been setup to do so. If shutdown() executes but stop() does not execute, NAPI remains enabled and this can lead to an exception if NAPI is scheduled while the hardware interface has only been partially deinitialized. The networking interface managed by the mlxbf_gige driver must be properly stopped during system shutdown so that IFF_UP is cleared, the hardware interface is put into a clean state, and NAPI is fully deinitialized. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: mlxbf_gige: detiene la interfaz durante el apagado El controlador mlxbf_gige encuentra intermitentemente una excepción de puntero NULL mientras el sistema se apaga mediante el comando "reboot". ... Sin embargo, el método stop() del controlador solo se ejecutará si la lógica de configuración de la interfaz de red dentro de la distribución de Linux se ha configurado para hacerlo. • https://git.kernel.org/stable/c/f92e1869d74e1acc6551256eb084a1c14a054e19 https://git.kernel.org/stable/c/63a10b530e22cc923008b5925821c26872f37971 https://git.kernel.org/stable/c/80247e0eca14ff177d565f58ecd3010f6b7910a4 https://git.kernel.org/stable/c/36a1cb0371aa6f0698910ee70cb4ed3c349f4fa4 https://git.kernel.org/stable/c/9783b3b0e71d704949214a8f76468f591a31f3f5 https://git.kernel.org/stable/c/09ba28e1cd3cf715daab1fca6e1623e22fd754a6 https://access.redhat.com/security/cve/CVE-2024-35885 https://bugzilla.redhat.com/show_bug.cgi?id=2281700 •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2024-35884 – udp: do not accept non-tunnel GSO skbs landing in a tunnel
https://notcve.org/view.php?id=CVE-2024-35884
In the Linux kernel, the following vulnerability has been resolved: udp: do not accept non-tunnel GSO skbs landing in a tunnel When rx-udp-gro-forwarding is enabled UDP packets might be GROed when being forwarded. ... RIP: 0010:skb_segment+0xd2a/0xf70 __udp_gso_segment+0xaa/0x560 En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: udp: no acepte skbs GSO que no sean de túnel que aterricen en un túnel Cuando rx-udp-gro-forwarding está habilitado, los paquetes UDP pueden recibir GRO al reenviarse. ... RIP: 0010:skb_segment+0xd2a/0xf70 __udp_gso_segment+0xaa/0x560 The following vulnerability has been resolved in the Linux kernel: udp: Fix - Do not accept non-tunnel GSO skbs landing in a tunnel. • https://git.kernel.org/stable/c/9fd1ff5d2ac7181844735806b0a703c942365291 https://git.kernel.org/stable/c/3391b157780bbedf8ef9f202cbf10ee90bf6b0f8 https://git.kernel.org/stable/c/d49ae15a5767d4e9ef8bbb79e42df1bfebc94670 https://git.kernel.org/stable/c/d12245080cb259d82b34699f6cd4ec11bdb688bd https://git.kernel.org/stable/c/3001e7aa43d6691db2a878b0745b854bf12ddd19 https://git.kernel.org/stable/c/35fe0e0b5c00bef7dde74842a2564c43856fbce4 https://git.kernel.org/stable/c/3d010c8031e39f5fa1e8b13ada77e0321091011f https://lists.debian.org/debian-lts-announce/2024/06/ •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-35883 – spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe
https://notcve.org/view.php?id=CVE-2024-35883
In the Linux kernel, the following vulnerability has been resolved: spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe In function pci1xxxx_spi_probe, there is a potential null pointer that may be caused by a failed memory allocation by the function devm_kzalloc. Hence, a null pointer check needs to be added to prevent null pointer dereferencing later in the code. To fix this issue, spi_bus->spi_int[iter] should be checked. ... En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: spi: mchp-pci1xxx: corrige una posible desreferencia de puntero null en pci1xxx_spi_probe En la función pci1xxxx_spi_probe, existe un posible puntero null que puede deberse a una asignación de memoria fallida por parte de la función devm_kzalloc. • https://git.kernel.org/stable/c/1cc0cbea7167af524a7f7b2d0d2f19f7a324e807 https://git.kernel.org/stable/c/4b31a226097cf8cc3c9de5e855d97757fdb2bf06 https://git.kernel.org/stable/c/95e5d9eb26705a9a76d2ef8bcba9ee2e195d653d https://git.kernel.org/stable/c/1f886a7bfb3faf4c1021e73f045538008ce7634e •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-35882 – SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP
https://notcve.org/view.php?id=CVE-2024-35882
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP Jan Schunk reports that his small NFS servers suffer from memory exhaustion after just a few days. ... En el kernel de Linux, se resolvió la siguiente vulnerabilidad: Revertir "drm/amd/display: Enviar mensaje de desactivación DTBCLK en la primera confirmación" Esto revierte la confirmación f341055b10bd8be55c3c995dff5f770b236b8ca9. • https://git.kernel.org/stable/c/e18e157bb5c8c1cd8a9ba25acfdcf4f3035836f4 https://git.kernel.org/stable/c/1ba1291172f935e6b6fe703161a948f3347400b8 https://git.kernel.org/stable/c/a2ebedf7bcd17a1194a0a18122c885eb578ee882 https://git.kernel.org/stable/c/05258a0a69b3c5d2c003f818702c0a52b6fea861 •