From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9C69061689 for ; Mon, 4 Mar 2024 18:07:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709575657; cv=none; b=o9SwwTVtF+yBxHNRFH49NfxkXYonH7bNOLSVjPOf5nU5B5YU6Zhl798ocsP7dXLfz9Si2OPKJQ/+Dn5vSGX18bCeDKbez8ImIjUkDIOfoVn90vs5EVGd2L9pgo5OGI3K871kVWkfoaNx0Yaw7Qwvn02E2bocJLmrU6FN8VsOg6s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709575657; c=relaxed/simple; bh=EGj3ISYhuYFANq6IpSgmL+QH+84Bkvdz3KPyc/YjtkU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=rB8cLbawxHLrXmc0ZSP4stfu47Yx4ixLm1CLoUYwfzLW9i4es5OLuF5hDy8WyDLhKlyJF8qRobF3/++PGRBqrE3JW4FEcH7Zi5M70MKn3VRb+Dcn5c6nU38zwoJMKd3Z+cLdQQM17Yt2osAasLUMT2Uz0I9GbUbKQqBu2KL4DAY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0wi/bWak; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="0wi/bWak" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 509D1C433F1; Mon, 4 Mar 2024 18:07:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1709575657; bh=EGj3ISYhuYFANq6IpSgmL+QH+84Bkvdz3KPyc/YjtkU=; h=From:To:Cc:Subject:Date:Reply-to:From; b=0wi/bWakrWuabceNUiOezAJvQ1vq9a8yAOzWAQ3bKJpOcf5Nk54U8KZT7UqYwmic0 BAix2PSZSX0hMr9/VDRClO2qge3fE2GurW+FItPI2pibk60rm77kyhE43E+AOWxcAB oKK7dA86abk6JcqZOQ72bP4dHPcJxsUE1bGYsgC4= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2021-47085: hamradio: improve the incomplete fix to avoid NPD Date: Mon, 4 Mar 2024 19:06:55 +0100 Message-ID: <2024030455-CVE-2021-47085-3c44@gregkh> X-Mailer: git-send-email 2.44.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3484; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=EGj3ISYhuYFANq6IpSgmL+QH+84Bkvdz3KPyc/YjtkU=; b=owGbwMvMwCRo6H6F97bub03G02pJDKnPePf/31TRmficf+vqpD2N0hskHWsfbKr4t85Hwvvgm jXzGCREO2JZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAiztwM81QVv7WwrfcU9ef4 VjaZmbV9a7K2OMNc0V/HLd6nd2aFhV1vnl/y85wu27z3AA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: hamradio: improve the incomplete fix to avoid NPD The previous commit 3e0588c291d6 ("hamradio: defer ax25 kfree after unregister_netdev") reorder the kfree operations and unregister_netdev operation to prevent UAF. This commit improves the previous one by also deferring the nullify of the ax->tty pointer. Otherwise, a NULL pointer dereference bug occurs. Partial of the stack trace is shown below. BUG: kernel NULL pointer dereference, address: 0000000000000538 RIP: 0010:ax_xmit+0x1f9/0x400 ... Call Trace: dev_hard_start_xmit+0xec/0x320 sch_direct_xmit+0xea/0x240 __qdisc_run+0x166/0x5c0 __dev_queue_xmit+0x2c7/0xaf0 ax25_std_establish_data_link+0x59/0x60 ax25_connect+0x3a0/0x500 ? security_socket_connect+0x2b/0x40 __sys_connect+0x96/0xc0 ? __hrtimer_init+0xc0/0xc0 ? common_nsleep+0x2e/0x50 ? switch_fpu_return+0x139/0x1a0 __x64_sys_connect+0x11/0x20 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The crash point is shown as below static void ax_encaps(...) { ... set_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags); // ax->tty = NULL! ... } By placing the nullify action after the unregister_netdev, the ax->tty pointer won't be assigned as NULL net_device framework layer is well synchronized. The Linux kernel CVE team has assigned CVE-2021-47085 to this issue. Affected and fixed versions =========================== Fixed in 4.4.297 with commit 371a874ea06f Fixed in 4.9.295 with commit 83ba6ec97c74 Fixed in 4.14.260 with commit a7b0ae2cc486 Fixed in 4.19.223 with commit b68f41c6320b Fixed in 5.4.169 with commit a5c6a13e9056 Fixed in 5.10.89 with commit 7dd52af1eb57 Fixed in 5.15.12 with commit 03d00f7f1815 Fixed in 5.16 with commit b2f37aead1b8 Please see https://www.kernel.org or a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2021-47085 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/hamradio/mkiss.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/371a874ea06f147d6ca30be43dad33683965eba6 https://git.kernel.org/stable/c/83ba6ec97c74fb1a60f7779a26b6a94b28741d8a https://git.kernel.org/stable/c/a7b0ae2cc486fcb601f9f9d87d98138cc7b7f7f9 https://git.kernel.org/stable/c/b68f41c6320b2b7fbb54a95f07a69f3dc7e56c59 https://git.kernel.org/stable/c/a5c6a13e9056d87805ba3042c208fbd4164ad22b https://git.kernel.org/stable/c/7dd52af1eb5798f590d9d9e1c56ed8f5744ee0ca https://git.kernel.org/stable/c/03d00f7f1815ec00dab5035851b3de83afd054a8 https://git.kernel.org/stable/c/b2f37aead1b82a770c48b5d583f35ec22aabb61e