From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7A1EA12D1ED for ; Fri, 24 May 2024 15:11:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716563466; cv=none; b=e+hBKFenPPEAmCExxRmFHrz7YqYsHy/1iG5S7rvbHq9xHLeOo47kh8AfhNiIhyIODYoVNbw6Z77CUuAgdaoIXQ/JFoaMR6xHyRTsqZ0rM6l8tvNQxtfO+jomJCAUoZ33jLvuVCPuIv8ljJqNSsYU3Tabe2TWuHZ4FqFHeErURRQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716563466; c=relaxed/simple; bh=urtE4w09HLpiSjKjbW0ap2t5UDhac+KWQsMyo8hDhOE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=gVtLfo1rsTJV2BNdIQHnlPv1ti2GEnUAzU2Hy57MBeYZa000PENc1G88srflCKKpX44LZTJUY6KvCN5mrxXSHBQCuLKBWrsfA/pG0A1dfAORoZjguUf1xdqkwAh/SEjGSSbh+TJppIjcfHri/uBtOXM/oTqBnUTNokdv+nKrnIA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0+UlsCtH; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="0+UlsCtH" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AC6F6C2BBFC; Fri, 24 May 2024 15:11:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1716563466; bh=urtE4w09HLpiSjKjbW0ap2t5UDhac+KWQsMyo8hDhOE=; h=From:To:Cc:Subject:Date:Reply-to:From; b=0+UlsCtHLMh+9aI91gfQ9ooTzWpQC2Nyd4CMfZ06A51ILHo1fX5smnnGKGfDPN2Q3 xAg48KPab7nNi/v6dlUN7Pc0RK3imf/0iYpTFRaqqsvzNgR3keXsbD5PtG9nUK2mIh 85bP3wFJca7yHV/S0IlrxuSYSOjK47oSFukdJ/0c= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2021-47517: ethtool: do not perform operations on net devices being unregistered Date: Fri, 24 May 2024 17:09:37 +0200 Message-ID: <2024052432-CVE-2021-47517-df40@gregkh> X-Mailer: git-send-email 2.45.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3187; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=urtE4w09HLpiSjKjbW0ap2t5UDhac+KWQsMyo8hDhOE=; b=owGbwMvMwCRo6H6F97bub03G02pJDGkBa9es06nvfcqU+S11g5jeq52b7TYsSJ9jKPhg8mX+2 0EftrE2d8SyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBE/HgZ5kf2pJzR1Cjv+ctl 8i6loW5WVC5jA8OC/asW7PQ9+/Z45fTSmTmn5554qRRbCQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: ethtool: do not perform operations on net devices being unregistered There is a short period between a net device starts to be unregistered and when it is actually gone. In that time frame ethtool operations could still be performed, which might end up in unwanted or undefined behaviours[1]. Do not allow ethtool operations after a net device starts its unregistration. This patch targets the netlink part as the ioctl one isn't affected: the reference to the net device is taken and the operation is executed within an rtnl lock section and the net device won't be found after unregister. [1] For example adding Tx queues after unregister ends up in NULL pointer exceptions and UaFs, such as: BUG: KASAN: use-after-free in kobject_get+0x14/0x90 Read of size 1 at addr ffff88801961248c by task ethtool/755 CPU: 0 PID: 755 Comm: ethtool Not tainted 5.15.0-rc6+ #778 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/014 Call Trace: dump_stack_lvl+0x57/0x72 print_address_description.constprop.0+0x1f/0x140 kasan_report.cold+0x7f/0x11b kobject_get+0x14/0x90 kobject_add_internal+0x3d1/0x450 kobject_init_and_add+0xba/0xf0 netdev_queue_update_kobjects+0xcf/0x200 netif_set_real_num_tx_queues+0xb4/0x310 veth_set_channels+0x1c3/0x550 ethnl_set_channels+0x524/0x610 The Linux kernel CVE team has assigned CVE-2021-47517 to this issue. Affected and fixed versions =========================== Issue introduced in 5.6 with commit 041b1c5d4a53 and fixed in 5.10.87 with commit 7c26da3be1e9 Issue introduced in 5.6 with commit 041b1c5d4a53 and fixed in 5.15.8 with commit cfd719f04267 Issue introduced in 5.6 with commit 041b1c5d4a53 and fixed in 5.16 with commit dde91ccfa25f Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2021-47517 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/ethtool/netlink.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/7c26da3be1e9843a15b5318f90db8a564479d2ac https://git.kernel.org/stable/c/cfd719f04267108f5f5bf802b9d7de69e99a99f9 https://git.kernel.org/stable/c/dde91ccfa25fd58f64c397d91b81a4b393100ffa