From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 33E4217106F for ; Fri, 21 Jun 2024 10:25:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1718965521; cv=none; b=DvLJcM9DXMQgRu3/HPS+ygadIMbVh74OliURQVqjPiSZI/afPSGdvZblJnbIfKB6VbGlG5OZTP3zlKAijI72ibBtUiVAHmu0Fqqmgry28vp8+5j061fr/hfNLCkLB2lhThV8KNqdbDdtl6CegD4hkv8iKfZNcJToRJYiKGuc89Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1718965521; c=relaxed/simple; bh=8j9fwKOFb+lAGd7Dlm/5Lex+zQjg5V+Pjp9zu3yHscs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=vGooUKIKHnjPHaVZsvttAiOVz7WOiROk0gYvvPsKzS96r7+xqhf2QQpS5WrK1SYCdNuTfqMzU8xQWh78Lm+QZFWXU+8BpY+fSsXmpwq5sHucj/PJxc0JATBube5/szHDuzert7Qo9qkNSSLk7iQ5rmk1bK3hUME3gsc2LTnBb/A= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=jyejmF+P; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="jyejmF+P" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AF3E5C2BBFC; Fri, 21 Jun 2024 10:25:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1718965521; bh=8j9fwKOFb+lAGd7Dlm/5Lex+zQjg5V+Pjp9zu3yHscs=; h=From:To:Cc:Subject:Date:Reply-to:From; b=jyejmF+PiD4E7XrpEdJGo2bngGNW0f5B6Odzb9nRgLURNfBLbr9Dt8PLNwP8q9jVU fvUi74wOfDm1eknRG8osC+spd1e1Gr0kQmecKy9o3xc4e26PmQ/pPLRD4cfirXmf5L 4qrovy8J/TfwpyFN9bK039edJRwFSYhfx1c4zfG4= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2024-36286: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() Date: Fri, 21 Jun 2024 12:19:37 +0200 Message-ID: <2024062135-CVE-2024-36286-ebd5@gregkh> X-Mailer: git-send-email 2.45.2 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=4926; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=8j9fwKOFb+lAGd7Dlm/5Lex+zQjg5V+Pjp9zu3yHscs=; b=owGbwMvMwCRo6H6F97bub03G02pJDGmlwds3vbCOWvbXYNfSZv0NNj8vtyW7fG9tu8V0ICqjQ LBJIPt3RywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAExkwmOGBYcW17VaXcrf+XDD njuz5co3/Zv+4zbDfJf2SQumSAf+lpk/ebdv+fw7642fzQAA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() syzbot reported that nf_reinject() could be called without rcu_read_lock() : WARNING: suspicious RCU usage 6.9.0-rc7-syzkaller-02060-g5c1672705a1a #0 Not tainted net/netfilter/nfnetlink_queue.c:263 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by syz-executor.4/13427: #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2190 [inline] #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_core+0xa86/0x1830 kernel/rcu/tree.c:2471 #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: nfqnl_flush net/netfilter/nfnetlink_queue.c:405 [inline] #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: instance_destroy_rcu+0x30/0x220 net/netfilter/nfnetlink_queue.c:172 stack backtrace: CPU: 0 PID: 13427 Comm: syz-executor.4 Not tainted 6.9.0-rc7-syzkaller-02060-g5c1672705a1a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712 nf_reinject net/netfilter/nfnetlink_queue.c:323 [inline] nfqnl_reinject+0x6ec/0x1120 net/netfilter/nfnetlink_queue.c:397 nfqnl_flush net/netfilter/nfnetlink_queue.c:410 [inline] instance_destroy_rcu+0x1ae/0x220 net/netfilter/nfnetlink_queue.c:172 rcu_do_batch kernel/rcu/tree.c:2196 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2471 handle_softirqs+0x2d6/0x990 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 The Linux kernel CVE team has assigned CVE-2024-36286 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.25 with commit 9872bec773c2 and fixed in 4.19.316 with commit 8658bd777cbf Issue introduced in 2.6.25 with commit 9872bec773c2 and fixed in 5.4.278 with commit 3989b817857f Issue introduced in 2.6.25 with commit 9872bec773c2 and fixed in 5.10.219 with commit e01065b339e3 Issue introduced in 2.6.25 with commit 9872bec773c2 and fixed in 5.15.161 with commit 25ea5377e3d2 Issue introduced in 2.6.25 with commit 9872bec773c2 and fixed in 6.1.93 with commit 68f40354a385 Issue introduced in 2.6.25 with commit 9872bec773c2 and fixed in 6.6.33 with commit 8f365564af89 Issue introduced in 2.6.25 with commit 9872bec773c2 and fixed in 6.9.4 with commit 215df6490e20 Issue introduced in 2.6.25 with commit 9872bec773c2 and fixed in 6.10-rc2 with commit dc21c6cc3d69 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-36286 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/netfilter/nfnetlink_queue.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/8658bd777cbfcb0c13df23d0ea120e70517761b9 https://git.kernel.org/stable/c/3989b817857f4890fab9379221a9d3f52bf5c256 https://git.kernel.org/stable/c/e01065b339e323b3dfa1be217fd89e9b3208b0ab https://git.kernel.org/stable/c/25ea5377e3d2921a0f96ae2551f5ab1b36825dd4 https://git.kernel.org/stable/c/68f40354a3851df46c27be96b84f11ae193e36c5 https://git.kernel.org/stable/c/8f365564af898819a523f1a8cf5c6ce053e9f718 https://git.kernel.org/stable/c/215df6490e208bfdd5b3012f5075e7f8736f3e7a https://git.kernel.org/stable/c/dc21c6cc3d6986d938efbf95de62473982c98dec