From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B024F6EB59 for ; Wed, 17 Apr 2024 10:30:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713349832; cv=none; b=SpIhV3pgGGU23c9M3G9Am4hlE84Q5CqVlHGX8K79qnwuskMZbdbKLqTpWQl/1PdvzDsefqQV2292Afph1QrhH3ddtJMqhUoHhRA5pF/ycMZETr2mjUWhXHohwKibEzaL2Uz5dcOm2DmCCk2SNy6SS58GV9mLhWad/dGRDtrSAYo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713349832; c=relaxed/simple; bh=8PSL8mBFnRjJ3brp7DLGg5M3ftFOCIvpxzbMV0SDNpY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=hGKIsjwz9eDtiu50mRo2tVycTd+bk09GoodV1OtBCg7kHj5jzh2/E4sIt8Nmfk1C6D7pJ6Fns6Iyr9DmdT17Ah2mHxBW08hELmz2gfUqcZUcntbf1tdPao/KXbCdtWLQOAUOi5GCP99DJUgYylU/gu4TMx58MO9xq2QDhIZcVWw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Nl2HlPvl; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Nl2HlPvl" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 34A57C072AA; Wed, 17 Apr 2024 10:30:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1713349832; bh=8PSL8mBFnRjJ3brp7DLGg5M3ftFOCIvpxzbMV0SDNpY=; h=From:To:Cc:Subject:Date:Reply-to:From; b=Nl2HlPvlXKulQxXwfxeFg51YQHmbSvoagfjT7A8j/wpScLeVgfBob7aejm2vJZh2G TUDveMEh0nJCbhk4ymbzTe1Yaxj99Jt3XzwxRiiIRlaf788LkvUlABfAJRHAmnCT8M AiLAYMraM0nfhFOEwMhWXoNAhRHt0jkkSrropT9Q= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2024-26898: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts Date: Wed, 17 Apr 2024 12:29:13 +0200 Message-ID: <2024041744-CVE-2024-26898-d199@gregkh> X-Mailer: git-send-email 2.44.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3872; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=8PSL8mBFnRjJ3brp7DLGg5M3ftFOCIvpxzbMV0SDNpY=; b=owGbwMvMwCRo6H6F97bub03G02pJDGnyS2I+nWgxUZz0NH36O12FTx5Jqmw7lotc+LnCM3i2b MS+k6ZiHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCRTS8Z5ukuu3BipmVg3Lqs 6W0vP9dq6MS+v8cwPyj933TF85WVDEeOOE05zrDpvcYrEwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts This patch is against CVE-2023-6270. The description of cve is: A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution. In aoecmd_cfg_pkts(), it always calls dev_put(ifp) when skb initial code is finished. But the net_device ifp will still be used in later tx()->dev_queue_xmit() in kthread. Which means that the dev_put(ifp) should NOT be called in the success path of skb initial code in aoecmd_cfg_pkts(). Otherwise tx() may run into use-after-free because the net_device is freed. This patch removed the dev_put(ifp) in the success path in aoecmd_cfg_pkts(), and added dev_put() after skb xmit in tx(). The Linux kernel CVE team has assigned CVE-2024-26898 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.22 with commit 7562f876cd93 and fixed in 4.19.311 with commit ad80c34944d7 Issue introduced in 2.6.22 with commit 7562f876cd93 and fixed in 5.4.273 with commit 1a54aa506b3b Issue introduced in 2.6.22 with commit 7562f876cd93 and fixed in 5.10.214 with commit faf0b4c5e00b Issue introduced in 2.6.22 with commit 7562f876cd93 and fixed in 5.15.153 with commit 7dd09fa80b07 Issue introduced in 2.6.22 with commit 7562f876cd93 and fixed in 6.1.83 with commit 74ca3ef68d2f Issue introduced in 2.6.22 with commit 7562f876cd93 and fixed in 6.6.23 with commit eb48680b0255 Issue introduced in 2.6.22 with commit 7562f876cd93 and fixed in 6.7.11 with commit 079cba4f4e30 Issue introduced in 2.6.22 with commit 7562f876cd93 and fixed in 6.8.2 with commit a16fbb800646 Issue introduced in 2.6.22 with commit 7562f876cd93 and fixed in 6.9-rc1 with commit f98364e92662 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-26898 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/block/aoe/aoecmd.c drivers/block/aoe/aoenet.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/ad80c34944d7175fa1f5c7a55066020002921a99 https://git.kernel.org/stable/c/1a54aa506b3b2f31496731039e49778f54eee881 https://git.kernel.org/stable/c/faf0b4c5e00bb680e8e43ac936df24d3f48c8e65 https://git.kernel.org/stable/c/7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4 https://git.kernel.org/stable/c/74ca3ef68d2f449bc848c0a814cefc487bf755fa https://git.kernel.org/stable/c/eb48680b0255a9e8a9bdc93d6a55b11c31262e62 https://git.kernel.org/stable/c/079cba4f4e307c69878226fdf5228c20aa1c969c https://git.kernel.org/stable/c/a16fbb80064634b254520a46395e36b87ca4731e https://git.kernel.org/stable/c/f98364e926626c678fb4b9004b75cacf92ff0662