From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 72EFA149E1A for ; Mon, 26 Aug 2024 10:23:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724667829; cv=none; b=vD3qYaRbTD9ltSTRtCZKfWdo5yfHiKiRLQCwKAeaRS29wq5yTByA0SUJJl6b+wEcVRBMphHX0oALi8voTjExHt/EeWof0YNDQI17dmviLQxkYQXHovVNaUiUrlj1FOZVIYxH1H1XJzSXGab3rERHlOgcwx1s8JY4YUAsIWZCRGQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724667829; c=relaxed/simple; bh=mjJ4JwTV9oRBJG901lpZgmQvLlQukjEttBs12jWRwQ4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=RldBVwGmN7i3tULhHuE7K0r0ndisZO+RMEBTEr2aecOPDgJm+wmX1IRbFqva6Fs1wFzaXiSNpEtgVjnVuPgCHUqcqN2fw3GnY3+TNmhaVhtkKFRW87ZTCbsGdD6/dD4G8gUWczt/7FxQ6eEI+7Icrs2w7AFYLAL8YpxcWSipoQA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=glJjtddK; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="glJjtddK" Received: by smtp.kernel.org (Postfix) with ESMTPSA id ED49DC5E88D; Mon, 26 Aug 2024 10:23:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1724667829; bh=mjJ4JwTV9oRBJG901lpZgmQvLlQukjEttBs12jWRwQ4=; h=From:To:Cc:Subject:Date:Reply-to:From; b=glJjtddKjswAfK+TLLybIkHAt+s3DbOelEj4cGw2iUrjt7+cuFtRDlrCcyigATuo7 4RvNTv4kPQUqkLkGex5OC3gllQh0L+YY8oGTevcxvDmMDa0naLutwYiO/RRHamwINy jem7htJRgcCrLuODa/M09XZi9Kr4/q3P++hVWNGk= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port Date: Mon, 26 Aug 2024 12:17:26 +0200 Message-ID: <2024082641-CVE-2024-44934-a7fe@gregkh> X-Mailer: git-send-email 2.46.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3807; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=mjJ4JwTV9oRBJG901lpZgmQvLlQukjEttBs12jWRwQ4=; b=owGbwMvMwCRo6H6F97bub03G02pJDGlnwlz/Tzn5sOAg26tX/KtnCDYoXmP3XaPEdWCJ13wJt hceE5cu7IhlYRBkYpAVU2T5so3n6P6KQ4pehranYeawMoEMYeDiFICJ6AkxzI/k+b/Xk79Xs/1T 5soVHE1izcaSKgwLZgV/Odm38bSt2nbWR1dcjJjLYxZyAAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: wait for previous gc cycles when removing port syzbot hit a use-after-free[1] which is caused because the bridge doesn't make sure that all previous garbage has been collected when removing a port. What happens is: CPU 1 CPU 2 start gc cycle remove port acquire gc lock first wait for lock call br_multicasg_gc() directly acquire lock now but free port the port can be freed while grp timers still running Make sure all previous gc cycles have finished by using flush_work before freeing the port. [1] BUG: KASAN: slab-use-after-free in br_multicast_port_group_expired+0x4c0/0x550 net/bridge/br_multicast.c:861 Read of size 8 at addr ffff888071d6d000 by task syz.5.1232/9699 CPU: 1 PID: 9699 Comm: syz.5.1232 Not tainted 6.10.0-rc5-syzkaller-00021-g24ca36a562d6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 br_multicast_port_group_expired+0x4c0/0x550 net/bridge/br_multicast.c:861 call_timer_fn+0x1a3/0x610 kernel/time/timer.c:1792 expire_timers kernel/time/timer.c:1843 [inline] __run_timers+0x74b/0xaf0 kernel/time/timer.c:2417 __run_timer_base kernel/time/timer.c:2428 [inline] __run_timer_base kernel/time/timer.c:2421 [inline] run_timer_base+0x111/0x190 kernel/time/timer.c:2437 The Linux kernel CVE team has assigned CVE-2024-44934 to this issue. Affected and fixed versions =========================== Issue introduced in 5.10 with commit e12cec65b554 and fixed in 5.15.165 with commit 1e16828020c6 Issue introduced in 5.10 with commit e12cec65b554 and fixed in 6.1.105 with commit 0d8b26e10e68 Issue introduced in 5.10 with commit e12cec65b554 and fixed in 6.6.46 with commit e3145ca904fa Issue introduced in 5.10 with commit e12cec65b554 and fixed in 6.10.5 with commit b2f794b168cf Issue introduced in 5.10 with commit e12cec65b554 and fixed in 6.11-rc3 with commit 92c4ee25208d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-44934 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/bridge/br_multicast.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/1e16828020c674b3be85f52685e8b80f9008f50f https://git.kernel.org/stable/c/0d8b26e10e680c01522d7cc14abe04c3265a928f https://git.kernel.org/stable/c/e3145ca904fa8dbfd1a5bf0187905bc117b0efce https://git.kernel.org/stable/c/b2f794b168cf560682ff976b255aa6d29d14a658 https://git.kernel.org/stable/c/92c4ee25208d0f35dafc3213cdf355fbe449e078