CVE-2024-35853

mlxsw: spectrum_acl_tcam: Fix memory leak during rehash

Severity Score

6.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum_acl_tcam: Fix memory leak during rehash

The rehash delayed work migrates filters from one region to another.
This is done by iterating over all chunks (all the filters with the same
priority) in the region and in each chunk iterating over all the
filters.

If the migration fails, the code tries to migrate the filters back to
the old region. However, the rollback itself can also fail in which case
another migration will be erroneously performed. Besides the fact that
this ping pong is not a very good idea, it also creates a problem.

Each virtual chunk references two chunks: The currently used one
('vchunk->chunk') and a backup ('vchunk->chunk2'). During migration the
first holds the chunk we want to migrate filters to and the second holds
the chunk we are migrating filters from.

The code currently assumes - but does not verify - that the backup chunk
does not exist (NULL) if the currently used chunk does not reference the
target region. This assumption breaks when we are trying to rollback a
rollback, resulting in the backup chunk being overwritten and leaked
[1].

Fix by not rolling back a failed rollback and add a warning to avoid
future cases.

[1]
WARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20
Modules linked in:
CPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G W 6.9.0-rc2-custom-00784-gc6a05c468a0b #14
Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019
Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work
RIP: 0010:parman_destroy+0x17/0x20
[...]
Call Trace:
<TASK>
mlxsw_sp_acl_atcam_region_fini+0x19/0x60
mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0
mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470
process_one_work+0x151/0x370
worker_thread+0x2cb/0x3e0
kthread+0xd0/0x100
ret_from_fork+0x34/0x50
ret_from_fork_asm+0x1a/0x30
</TASK>

En el kernel de Linux, se resolvió la siguiente vulnerabilidad: mlxsw: spectrum_acl_tcam: corrige la pérdida de memoria durante el rehash El trabajo retrasado del rehash migra los filtros de una región a otra. Esto se hace iterando sobre todos los fragmentos (todos los filtros con la misma prioridad) en la región y en cada fragmento iterando sobre todos los filtros. Si la migración fallo, el código intenta migrar los filtros nuevamente a la región anterior. Sin embargo, la reversión en sí también puede fallor, en cuyo caso se realizará otra migración por error. Además de que este ping pong no es una muy buena idea, también crea un problema. Cada fragmento virtual hace referencia a dos fragmentos: el que se utiliza actualmente ('vchunk->chunk') y una copia de seguridad ('vchunk->chunk2'). Durante la migración, el primero contiene el fragmento al que queremos migrar los filtros y el segundo contiene el fragmento desde el que estamos migrando los filtros. Actualmente, el código supone, pero no verifica, que el fragmento de copia de seguridad no existe (NULL) si el fragmento utilizado actualmente no hace referencia a la región de destino. Esta suposición se rompe cuando intentamos revertir una reversión, lo que provoca que el fragmento de copia de seguridad se sobrescriba y se filtre [1]. Corrija al no revertir una reversión fallida y agregue una advertencia para evitar casos futuros. [1] ADVERTENCIA: CPU: 5 PID: 1063 en lib/parman.c:291 parman_destroy+0x17/0x20 Módulos vinculados en: CPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: GW 6.9.0-rc2- custom-00784-gc6a05c468a0b #14 Nombre del hardware: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 06/01/2019 Cola de trabajo: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:parman_destroy+0x17/0x20 [...] : mlxsw_sp_acl_atcam_region_fini +0x19/0x60 mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470 proceso_one_work+0x151/0x370 trabajador_hilo+0x2cb/0x3e0 kthread+0xd0/0x100 k+0x34/0x50 ret_from_fork_asm+0x1a/0x30

*Credits: N/A

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-17 CVE Reserved
2024-05-17 CVE Published
2024-05-18 EPSS Updated
2024-12-19 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-416: Use After Free

CAPEC

References (11)

URL	Tag	Source
https://git.kernel.org/stable/c/843500518509128a935edab96bd8efef7c54669e	Vuln. Introduced
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/c6f3fa7f5a748bf6e5c4eb742686d6952f854e76	2024-05-02
https://git.kernel.org/stable/c/617e98ba4c50f4547c9eb0946b1cfc26937d70d1	2024-05-02
https://git.kernel.org/stable/c/413a01886c3958d4b8aac23a3bff3d430b92093e	2024-05-02
https://git.kernel.org/stable/c/b822644fd90992ee362c5e0c8d2556efc8856c76	2024-05-02
https://git.kernel.org/stable/c/0ae8ff7b6d42e33943af462910bdcfa2ec0cb8cf	2024-05-02
https://git.kernel.org/stable/c/b3fd51f684a0711504f82de510da109ae639722d	2024-05-02
https://git.kernel.org/stable/c/8ca3f7a7b61393804c46f170743c3b839df13977	2024-04-25

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2024-35853	2024-11-12
https://bugzilla.redhat.com/show_bug.cgi?id=2281255	2024-11-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.1 < 5.4.275 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.1 < 5.4.275"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.1 < 5.10.216 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.1 < 5.10.216"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.1 < 5.15.158 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.1 < 5.15.158"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.1 < 6.1.90 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.1 < 6.1.90"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.1 < 6.6.30 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.1 < 6.6.30"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.1 < 6.8.9 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.1 < 6.8.9"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.1 < 6.9 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.1 < 6.9"		en		Affected