From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5C51F12F388 for ; Tue, 21 May 2024 14:21:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716301270; cv=none; b=cTVDQnhZ4joRqasW5Y9IW6+1h68PZlGxErsOUBlAlviUSeJCF1zT0I+/FEZis6OZ48druKOBW1XMhl+HABvznodUWWzcPKNJ1CjhixQvvfhtqiq5Dz6b69+0BeN2CAgGUBJZXe5BmBw1xVh7EPxfvXRfuiSKkmLcN/lw4OxMTpc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716301270; c=relaxed/simple; bh=toUpXajxIM74fEciTWp6OjjEGBP9/fkggz0TSRhg4Oc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=qne7TLgGOsSMlkRKM1GqD1Jn9gNND5t+G6/nX8jCNGpADCj1/pthq22UtRuA/08/Pn4k8/aOBzbIENBH6LJIFgCKzt17Be9xX5+zE8VjzGwzjpOnBaBvpLNlN4O3J2RwJ8qIeY/0f15WPvRFNN8T52TzT95YaXQiJXo1hjgiLPo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=kNBBOHFw; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="kNBBOHFw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 921E1C4AF08; Tue, 21 May 2024 14:21:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1716301269; bh=toUpXajxIM74fEciTWp6OjjEGBP9/fkggz0TSRhg4Oc=; h=From:To:Cc:Subject:Date:Reply-to:From; b=kNBBOHFwwvRSfTBWljlTLfP7zWEmfrbUwknbGeUKcfdqBmYlYurS0JYiMSWDXlPDC OrWDA42w4b1Ssc1wGrFvGja6zs8wXcc7Fpwz8IcNLOy1MVJwlvlEYhr6gmi9OvVg7I yn3N/HMQ9tegqHDEonWipE9FLsTP5TFqr0DWkxhw= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2021-47237: net: hamradio: fix memory leak in mkiss_close Date: Tue, 21 May 2024 16:19:51 +0200 Message-ID: <2024052140-CVE-2021-47237-52cf@gregkh> X-Mailer: git-send-email 2.45.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=6319; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=toUpXajxIM74fEciTWp6OjjEGBP9/fkggz0TSRhg4Oc=; b=owGbwMvMwCRo6H6F97bub03G02pJDGk+a2vWreT8wq5p8u5ykcclB0PPvLqSS69u6gt4S6joW mR+27ixI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACbSeIVhnmZ8cf8r2YqNR+vX hnFO1FrX/b2QgWG+L9P8kLCv0TaM3+w3/jquGrkpZ/F9AA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: net: hamradio: fix memory leak in mkiss_close My local syzbot instance hit memory leak in mkiss_open()[1]. The problem was in missing free_netdev() in mkiss_close(). In mkiss_open() netdevice is allocated and then registered, but in mkiss_close() netdevice was only unregistered, but not freed. Fail log: BUG: memory leak unreferenced object 0xffff8880281ba000 (size 4096): comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): 61 78 30 00 00 00 00 00 00 00 00 00 00 00 00 00 ax0............. 00 27 fa 2a 80 88 ff ff 00 00 00 00 00 00 00 00 .'.*............ backtrace: [] kvmalloc_node+0x61/0xf0 [] alloc_netdev_mqs+0x98/0xe80 [] mkiss_open+0xb2/0x6f0 [1] [] tty_ldisc_open+0x9b/0x110 [] tty_set_ldisc+0x2e8/0x670 [] tty_ioctl+0xda3/0x1440 [] __x64_sys_ioctl+0x193/0x200 [] do_syscall_64+0x3a/0xb0 [] entry_SYSCALL_64_after_hwframe+0x44/0xae BUG: memory leak unreferenced object 0xffff8880141a9a00 (size 96): comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): e8 a2 1b 28 80 88 ff ff e8 a2 1b 28 80 88 ff ff ...(.......(.... 98 92 9c aa b0 40 02 00 00 00 00 00 00 00 00 00 .....@.......... backtrace: [] __hw_addr_create_ex+0x5b/0x310 [] __hw_addr_add_ex+0x1f8/0x2b0 [] dev_addr_init+0x10b/0x1f0 [] alloc_netdev_mqs+0x13b/0xe80 [] mkiss_open+0xb2/0x6f0 [1] [] tty_ldisc_open+0x9b/0x110 [] tty_set_ldisc+0x2e8/0x670 [] tty_ioctl+0xda3/0x1440 [] __x64_sys_ioctl+0x193/0x200 [] do_syscall_64+0x3a/0xb0 [] entry_SYSCALL_64_after_hwframe+0x44/0xae BUG: memory leak unreferenced object 0xffff8880219bfc00 (size 512): comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): 00 a0 1b 28 80 88 ff ff 80 8f b1 8d ff ff ff ff ...(............ 80 8f b1 8d ff ff ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [] kvmalloc_node+0x61/0xf0 [] alloc_netdev_mqs+0x777/0xe80 [] mkiss_open+0xb2/0x6f0 [1] [] tty_ldisc_open+0x9b/0x110 [] tty_set_ldisc+0x2e8/0x670 [] tty_ioctl+0xda3/0x1440 [] __x64_sys_ioctl+0x193/0x200 [] do_syscall_64+0x3a/0xb0 [] entry_SYSCALL_64_after_hwframe+0x44/0xae BUG: memory leak unreferenced object 0xffff888029b2b200 (size 256): comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kvmalloc_node+0x61/0xf0 [] alloc_netdev_mqs+0x912/0xe80 [] mkiss_open+0xb2/0x6f0 [1] [] tty_ldisc_open+0x9b/0x110 [] tty_set_ldisc+0x2e8/0x670 [] tty_ioctl+0xda3/0x1440 [] __x64_sys_ioctl+0x193/0x200 [] do_syscall_64+0x3a/0xb0 [] entry_SYSCALL_64_after_hwframe+0x44/0xae The Linux kernel CVE team has assigned CVE-2021-47237 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.14 with commit 815f62bf7427 and fixed in 4.4.274 with commit c634ba0b4159 Issue introduced in 2.6.14 with commit 815f62bf7427 and fixed in 4.9.274 with commit 3942d0f9ace1 Issue introduced in 2.6.14 with commit 815f62bf7427 and fixed in 4.14.238 with commit 765a8a04f828 Issue introduced in 2.6.14 with commit 815f62bf7427 and fixed in 4.19.196 with commit c16c4716a1b5 Issue introduced in 2.6.14 with commit 815f62bf7427 and fixed in 5.4.128 with commit a49cbb762ef2 Issue introduced in 2.6.14 with commit 815f62bf7427 and fixed in 5.10.46 with commit 290b0b6432e2 Issue introduced in 2.6.14 with commit 815f62bf7427 and fixed in 5.12.13 with commit f4de2b43d13b Issue introduced in 2.6.14 with commit 815f62bf7427 and fixed in 5.13 with commit 7edcc6823014 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2021-47237 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/hamradio/mkiss.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c634ba0b4159838ff45a60d3a0ace3b4118077a5 https://git.kernel.org/stable/c/3942d0f9ace1a95a74930b5b4fc0e5005c62b37b https://git.kernel.org/stable/c/765a8a04f828db7222b36a42b1031f576bfe95c3 https://git.kernel.org/stable/c/c16c4716a1b5ba4f83c7e00da457cba06761f119 https://git.kernel.org/stable/c/a49cbb762ef20655f5c91abdc13658b0af5e159d https://git.kernel.org/stable/c/290b0b6432e2599021db0b8d6046f756d931c29f https://git.kernel.org/stable/c/f4de2b43d13b7cf3ced9310e371b90c836dbd7cd https://git.kernel.org/stable/c/7edcc682301492380fbdd604b4516af5ae667a13