From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5DAC73F9C5 for ; Fri, 27 Dec 2024 13:53:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1735307623; cv=none; b=AxYjmC+7DGo11aPM/PZHqorg7d75d6lOWeAQ0Y8k1m0fBKZxNmDe4n7Y9oPQ06VJd9mEdUv8/KNbfOyKOLjAzXaIfkBKvBtW3CY7JWNuG1DHVxHH0nWnCsBJKZtNvwycnQijrlfvCRZr4BiN9JTZ21qcw07YV8Ab5kVaax03GGw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1735307623; c=relaxed/simple; bh=if5EPKQ96od/xzB2IStYYK5kpC9I/N1p+xvKgg3vrZ8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Dh/kjTCIbKZb5j74MEgixY3SmgqZ/jcInphJbN1xxvqa8xc1BH24hRI9SvEQdTDleKdQUN9rGUzjEQ+ZQ/hnbbmtaOYUHZrwOCP5E5gGDkrsxKXUmKWStJnlviMP66tRjmfVQDpC4BqPc24LEWgXdPxXHuZO+PgoDUbZ2KqZg/s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Xmn9+eVH; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Xmn9+eVH" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CFF3CC4CED0; Fri, 27 Dec 2024 13:53:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1735307623; bh=if5EPKQ96od/xzB2IStYYK5kpC9I/N1p+xvKgg3vrZ8=; h=From:To:Cc:Subject:Date:Reply-to:From; b=Xmn9+eVHA1+7qkE42MbabnIHR4CuZVG157M3c9W0MbTNmzwBjgBPGJrLTDB+zhvt+ t12EXDW3SpUBni/a5KyUw9F2bc46Zxah8TEJt0Z3+Hnnp0wUHu7vFmRkX59e+yV0z3 CbAeOsJRx3HDM0Ghm7kldLuRxSmMbcH/AYPMmIFE= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2024-53172: ubi: fastmap: Fix duplicate slab cache names while attaching Date: Fri, 27 Dec 2024 14:52:18 +0100 Message-ID: <2024122716-CVE-2024-53172-217d@gregkh> X-Mailer: git-send-email 2.47.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=4455; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=if5EPKQ96od/xzB2IStYYK5kpC9I/N1p+xvKgg3vrZ8=; b=kA0DAAIRMUfUDdst+ykByyZiAGdusRGheOILya+gKXmzMW524j+AN7eQRPuFSd5Yazt2figeD ohdBAARAgAdFiEE9LYMxb94wiFKMT3LMUfUDdst+ykFAmdusREACgkQMUfUDdst+ylgAACgnXAl pGakmb2P9V2aM9GHITw/SqAAoMTOkUbFO6h3dCEZ74urhBkoQosn X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: ubi: fastmap: Fix duplicate slab cache names while attaching Since commit 4c39529663b9 ("slab: Warn on duplicate cache names when DEBUG_VM=y"), the duplicate slab cache names can be detected and a kernel WARNING is thrown out. In UBI fast attaching process, alloc_ai() could be invoked twice with the same slab cache name 'ubi_aeb_slab_cache', which will trigger following warning messages: kmem_cache of name 'ubi_aeb_slab_cache' already exists WARNING: CPU: 0 PID: 7519 at mm/slab_common.c:107 __kmem_cache_create_args+0x100/0x5f0 Modules linked in: ubi(+) nandsim [last unloaded: nandsim] CPU: 0 UID: 0 PID: 7519 Comm: modprobe Tainted: G 6.12.0-rc2 RIP: 0010:__kmem_cache_create_args+0x100/0x5f0 Call Trace: __kmem_cache_create_args+0x100/0x5f0 alloc_ai+0x295/0x3f0 [ubi] ubi_attach+0x3c3/0xcc0 [ubi] ubi_attach_mtd_dev+0x17cf/0x3fa0 [ubi] ubi_init+0x3fb/0x800 [ubi] do_init_module+0x265/0x7d0 __x64_sys_finit_module+0x7a/0xc0 The problem could be easily reproduced by loading UBI device by fastmap with CONFIG_DEBUG_VM=y. Fix it by using different slab names for alloc_ai() callers. The Linux kernel CVE team has assigned CVE-2024-53172 to this issue. Affected and fixed versions =========================== Issue introduced in 4.1 with commit d2158f69a7d469c21c37f7028c18aa8c54707de3 and fixed in 4.19.325 with commit ef52b7191ac41e68b1bf070d00c5b04ed16e4920 Issue introduced in 4.1 with commit d2158f69a7d469c21c37f7028c18aa8c54707de3 and fixed in 5.4.287 with commit 871c148f8e0c32e505df9393ba4a303c3c3fe988 Issue introduced in 4.1 with commit d2158f69a7d469c21c37f7028c18aa8c54707de3 and fixed in 5.10.231 with commit 04c0b0f37617099479c34e207c5550d081f585a6 Issue introduced in 4.1 with commit d2158f69a7d469c21c37f7028c18aa8c54707de3 and fixed in 5.15.174 with commit b1ee0aa4945c49cbbd779da81040fcec4de80fd1 Issue introduced in 4.1 with commit d2158f69a7d469c21c37f7028c18aa8c54707de3 and fixed in 6.1.120 with commit 6afdcb285794e75d2c8995e3a44f523c176cc2de Issue introduced in 4.1 with commit d2158f69a7d469c21c37f7028c18aa8c54707de3 and fixed in 6.6.64 with commit 612824dd0c9465ef365ace38b056c663d110956d Issue introduced in 4.1 with commit d2158f69a7d469c21c37f7028c18aa8c54707de3 and fixed in 6.11.11 with commit 3d8558135cd56a2a8052024be4073e160f36658c Issue introduced in 4.1 with commit d2158f69a7d469c21c37f7028c18aa8c54707de3 and fixed in 6.12.2 with commit 7402c4bcb8a3f0d2ef4e687cd45c76be489cf509 Issue introduced in 4.1 with commit d2158f69a7d469c21c37f7028c18aa8c54707de3 and fixed in 6.13-rc1 with commit bcddf52b7a17adcebc768d26f4e27cf79adb424c Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-53172 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/mtd/ubi/attach.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/ef52b7191ac41e68b1bf070d00c5b04ed16e4920 https://git.kernel.org/stable/c/871c148f8e0c32e505df9393ba4a303c3c3fe988 https://git.kernel.org/stable/c/04c0b0f37617099479c34e207c5550d081f585a6 https://git.kernel.org/stable/c/b1ee0aa4945c49cbbd779da81040fcec4de80fd1 https://git.kernel.org/stable/c/6afdcb285794e75d2c8995e3a44f523c176cc2de https://git.kernel.org/stable/c/612824dd0c9465ef365ace38b056c663d110956d https://git.kernel.org/stable/c/3d8558135cd56a2a8052024be4073e160f36658c https://git.kernel.org/stable/c/7402c4bcb8a3f0d2ef4e687cd45c76be489cf509 https://git.kernel.org/stable/c/bcddf52b7a17adcebc768d26f4e27cf79adb424c