From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 74328225D7 for ; Thu, 22 Aug 2024 03:32:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724297542; cv=none; b=e8IjXh2yblyCyLEhC/3DGdaqOQMOG1Bn/4vq03fcVthVCbddSMpk//TVOcu76ArRcadjfJejhXjeZND+QVVhuebY7Bc72UiIa6NVB+HcMogP68gpZmnC2KeccQoHeTlmgEhy507DGdZnuQQw4SDp+nk0KxqTp+OuV1ChkPfEK/Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724297542; c=relaxed/simple; bh=YJSAgaob6UnjbmZxJinjsDcEDM7TYDAqKAcaGxHTu1s=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=nKJtuHncrEq0XDJoBiYW8EIUmf1FK2s0tpsegzYLeGRDvRbFJlnBPMV6NaYMVfh2jyAPtrlxR1U28aGOoJJb4gmDxF6xBSKhMF639tpy3DCcZKgVcVyDMMXfyAYap0bInSBkJIFRSuszLisi6iuaO/KX6E1APiSwGHCqzs9YEL0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QJO1OAj4; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="QJO1OAj4" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8110CC4AF09; Thu, 22 Aug 2024 03:32:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1724297542; bh=YJSAgaob6UnjbmZxJinjsDcEDM7TYDAqKAcaGxHTu1s=; h=From:To:Cc:Subject:Date:Reply-to:From; b=QJO1OAj4qPhnjNCJaayifIYgFp6tY3a1CmGvBlz/FrheM2LPjYiDmRnWeNcVCnBuD gCmFSBbjaeed0K1XMRsXDO7m4Z9wbxx8O+oVWxyG9nJW5uYcGa9xNO8un1u4yzSqKf EoG1w9XBt8hszUkYFeqV+lQ5A/6Yda/cA8C4O8xU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-48900: xen/netfront: react properly to failing gnttab_end_foreign_access_ref() Date: Thu, 22 Aug 2024 11:31:01 +0800 Message-ID: <2024082210-CVE-2022-48900-c15e@gregkh> X-Mailer: git-send-email 2.46.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2876; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=YJSAgaob6UnjbmZxJinjsDcEDM7TYDAqKAcaGxHTu1s=; b=owGbwMvMwCRo6H6F97bub03G02pJDGnHNvxjZDNSMm6Qlwhb/fZFiYncvsx7JTI3PbeEaSu9a dNaouTREcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABPZosWwYOKGCdf3xMRK33L4 Uxz7Q+fDhK0f/Bnm+093ntCoU8N3pi6s7FtnyPObf/teAgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: xen/netfront: react properly to failing gnttab_end_foreign_access_ref() When calling gnttab_end_foreign_access_ref() the returned value must be tested and the reaction to that value should be appropriate. In case of failure in xennet_get_responses() the reaction should not be to crash the system, but to disable the network device. The calls in setup_netfront() can be replaced by calls of gnttab_end_foreign_access(). While at it avoid double free of ring pages and grant references via xennet_disconnect_backend() in this case. This is CVE-2022-23042 / part of XSA-396. --- V2: - avoid double free V3: - remove pointless initializer (Jan Beulich) The Linux kernel CVE team has assigned CVE-2022-48900 to this issue. Affected and fixed versions =========================== Fixed in 4.9.306 with commit c4497b057b14 Fixed in 4.14.271 with commit 1b9f4115738a Fixed in 4.19.234 with commit c307029d811e Fixed in 5.4.184 with commit 0e35f3ab69bc Fixed in 5.10.105 with commit 206c8e271ba2 Fixed in 5.15.28 with commit dea18aef2021 Fixed in 5.16.14 with commit 34630641e955 Fixed in 5.17 with commit 66e3531b33ee Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-48900 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/xen-netfront.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c4497b057b14274e159434f0ed70439a21f3d2a9 https://git.kernel.org/stable/c/1b9f4115738af90427a8c94a3980bc52fbb23296 https://git.kernel.org/stable/c/c307029d811e03546d18d0e512fe295b3103b8e5 https://git.kernel.org/stable/c/0e35f3ab69bcb01fdbf5aadc78f1731778963b1c https://git.kernel.org/stable/c/206c8e271ba2630f1d809123945d9c428f93b0f0 https://git.kernel.org/stable/c/dea18aef2021022a568f4d385a1386f51a9df6ff https://git.kernel.org/stable/c/34630641e955f23ae06db178822d99d0a9d89b20 https://git.kernel.org/stable/c/66e3531b33ee51dad17c463b4d9c9f52e341503d