CVE-2024-50147

net/mlx5: Fix command bitmask initialization

Severity Score

"-"

*CVSS v-

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix command bitmask initialization

Command bitmask have a dedicated bit for MANAGE_PAGES command, this bit
isn't Initialize during command bitmask Initialization, only during
MANAGE_PAGES.

In addition, mlx5_cmd_trigger_completions() is trying to trigger
completion for MANAGE_PAGES command as well.

Hence, in case health error occurred before any MANAGE_PAGES command
have been invoke (for example, during mlx5_enable_hca()),
mlx5_cmd_trigger_completions() will try to trigger completion for
MANAGE_PAGES command, which will result in null-ptr-deref error.[1]

Fix it by Initialize command bitmask correctly.

While at it, re-write the code for better understanding.

[1]
BUG: KASAN: null-ptr-deref in mlx5_cmd_trigger_completions+0x1db/0x600 [mlx5_core]
Write of size 4 at addr 0000000000000214 by task kworker/u96:2/12078
CPU: 10 PID: 12078 Comm: kworker/u96:2 Not tainted 6.9.0-rc2_for_upstream_debug_2024_04_07_19_01 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
Workqueue: mlx5_health0000:08:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]
Call Trace:
<TASK>
dump_stack_lvl+0x7e/0xc0
kasan_report+0xb9/0xf0
kasan_check_range+0xec/0x190
mlx5_cmd_trigger_completions+0x1db/0x600 [mlx5_core]
mlx5_cmd_flush+0x94/0x240 [mlx5_core]
enter_error_state+0x6c/0xd0 [mlx5_core]
mlx5_fw_fatal_reporter_err_work+0xf3/0x480 [mlx5_core]
process_one_work+0x787/0x1490
? lockdep_hardirqs_on_prepare+0x400/0x400
? pwq_dec_nr_in_flight+0xda0/0xda0
? assign_work+0x168/0x240
worker_thread+0x586/0xd30
? rescuer_thread+0xae0/0xae0
kthread+0x2df/0x3b0
? kthread_complete_and_exit+0x20/0x20
ret_from_fork+0x2d/0x70
? kthread_complete_and_exit+0x20/0x20
ret_from_fork_asm+0x11/0x20
</TASK>

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5: Arreglar la inicialización de la máscara de bits del comando La máscara de bits del comando tiene un bit dedicado para el comando MANAGE_PAGES, este bit no se inicializa durante la inicialización de la máscara de bits del comando, solo durante MANAGE_PAGES. Además, mlx5_cmd_trigger_completions() también intenta activar la finalización del comando MANAGE_PAGES. Por lo tanto, en caso de que se produzca un error de estado antes de que se haya invocado cualquier comando MANAGE_PAGES (por ejemplo, durante mlx5_enable_hca()), mlx5_cmd_trigger_completions() intentará activar la finalización del comando MANAGE_PAGES, lo que dará como resultado un error null-ptr-deref.[1] Arréglalo inicializando la máscara de bits del comando correctamente. Mientras lo haces, reescribe el código para una mejor comprensión. [1] ERROR: KASAN: null-ptr-deref en mlx5_cmd_trigger_completions+0x1db/0x600 [mlx5_core] Escritura de tamaño 4 en la dirección 0000000000000214 por la tarea kworker/u96:2/12078 CPU: 10 PID: 12078 Comm: kworker/u96:2 No contaminado 6.9.0-rc2_for_upstream_debug_2024_04_07_19_01 #1 Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Cola de trabajo: mlx5_health0000:08:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core] Seguimiento de llamadas: dump_stack_lvl+0x7e/0xc0 kasan_report+0xb9/0xf0 kasan_check_range+0xec/0x190 mlx5_cmd_trigger_completions+0x1db/0x600 [mlx5_core] mlx5_cmd_flush+0x94/0x240 [mlx5_core] enter_error_state+0x6c/0xd0 [mlx5_core] mlx5_fw_fatal_reporter_err_work+0xf3/0x480 [mlx5_core] process_one_work+0x787/0x1490 ? lockdep_hardirqs_on_prepare+0x400/0x400 ? pwq_dec_nr_in_flight+0xda0/0xda0 ? asignar_trabajo+0x168/0x240 subproceso_trabajador+0x586/0xd30 ? subproceso_rescatador+0xae0/0xae0 subproceso_k+0x2df/0x3b0 ? subproceso_k_completo_y_salir+0x20/0x20 ret_de_la_bifurcación+0x2d/0x70 ? subproceso_k_completo_y_salir+0x20/0x20 ret_de_la_bifurcación_asm+0x11/0x20

*Credits: N/A

CVSS Scores

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2024-10-21 CVE Reserved
2024-11-07 CVE Published
2024-11-19 CVE Updated
2024-11-19 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (5)

URL	Tag	Source
https://git.kernel.org/stable/c/9b98d395b85dd042fe83fb696b1ac02e6c93a520	Vuln. Introduced

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/d1606090bb294cecb7de3c4ed177f5aa0abd4c4e	2024-11-01
https://git.kernel.org/stable/c/d88564c79d1cedaf2655f12261eca0d2796bde4e	2024-11-01
https://git.kernel.org/stable/c/2feac1e562be0efc621a6722644a90f355d53473	2024-11-01
https://git.kernel.org/stable/c/d62b14045c6511a7b2d4948d1a83a4e592deeb05	2024-10-17

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 6.1 < 6.1.115 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.1 < 6.1.115"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 6.1 < 6.6.59 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.1 < 6.6.59"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 6.1 < 6.11.6 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.1 < 6.11.6"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 6.1 < 6.12 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.1 < 6.12"		en		Affected