From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7454B3612F3 for ; Sun, 26 Jul 2026 06:30:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785047426; cv=none; b=QFCFePPdnLdnkVrQY1NiVqdLa3HMQu2QxEVNpBwHHmwWqjH2c/P3dkDk7qXND+MwlrAy/YefJsXgsS0N+4mPTDBqmEDQpEa2402XOlUMh6QzOPHP2I15kdYM2mjAi8RhWl1H9mbonv0qpZfqpXxb9OEtS+FFzaPtAQv0lyRaJmo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785047426; c=relaxed/simple; bh=AliUWNH/PFs84Kvp9LaYoJEui4bM190/leWT9PBvPwY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=C2uCvQN6jJjsUZulpFwlkffrFuq6bzAu6vu5SUsiZFQU1/b6xZX8NuRFh5eZrOS166uyfOJEZ5tdE+XeP2/9UoQqln5JJKSeSe+wJkKEprLmXeNOcT7xjhv1UQCuftWn6c4VzIh21/Zxew2JejXtsNPMzL/SaWjsDCWhGzU2K58= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Rk6vYn2S; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Rk6vYn2S" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8D3F21F000E9; Sun, 26 Jul 2026 06:30:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1785047425; bh=XRADB8n+gh7uqJVgkeOecrtEFlRUOgUtq7Oglw+WuPE=; h=From:To:Cc:Subject:Date:Reply-To; b=Rk6vYn2SI3F64U6Nrxq48e45HE/rIqEvzT+x5rgqcVT/RLKyojCoREBo80HfRISY4 epqhWPRMr38b9F3ejBwAviedgT30Oe3gg/HzHUi8FfcaCRq10LQqyccNeDw68Aa68/ bvqTcWEmNdLqeKAWiVuRvMssMzX9BTdTCgOVrZJo= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2024-14040: net: nexthop: Increase weight to u16 Date: Sun, 26 Jul 2026 08:28:59 +0200 Message-ID: <2026072658-CVE-2024-14040-ceac@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4527; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=HDiA+KTU/HCZ6yKEV1sVPLgxlesgV4P3yYn80/1iP3M=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmpK7Vr0nseskns9G95VvXymmGV+hmzaX6PM27feVZxc +Ym/l+TO2JZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAiWT8ZFuwvjp5Utjbj5OGT lqLS1Q2Ks75PWc+wYPnzbJH3T6wYl+c17tnoPllzyYriawA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Increase weight to u16 In CLOS networks, as link failures occur at various points in the network, ECMP weights of the involved nodes are adjusted to compensate. With high fan-out of the involved nodes, and overall high number of nodes, a (non-)ECMP weight ratio that we would like to configure does not fit into 8 bits. Instead of, say, 255:254, we might like to configure something like 1000:999. For these deployments, the 8-bit weight may not be enough. To that end, in this patch increase the next hop weight from u8 to u16. Increasing the width of an integral type can be tricky, because while the code still compiles, the types may not check out anymore, and numerical errors come up. To prevent this, the conversion was done in two steps. First the type was changed from u8 to a single-member structure, which invalidated all uses of the field. This allowed going through them one by one and audit for type correctness. Then the structure was replaced with a vanilla u16 again. This should ensure that no place was missed. The UAPI for configuring nexthop group members is that an attribute NHA_GROUP carries an array of struct nexthop_grp entries: struct nexthop_grp { __u32 id; /* nexthop id - must exist */ __u8 weight; /* weight of this nexthop */ __u8 resvd1; __u16 resvd2; }; The field resvd1 is currently validated and required to be zero. We can lift this requirement and carry high-order bits of the weight in the reserved field: struct nexthop_grp { __u32 id; /* nexthop id - must exist */ __u8 weight; /* weight of this nexthop */ __u8 weight_high; __u16 resvd2; }; Keeping the fields split this way was chosen in case an existing userspace makes assumptions about the width of the weight field, and to sidestep any endianness issues. The weight field is currently encoded as the weight value minus one, because weight of 0 is invalid. This same trick is impossible for the new weight_high field, because zero must mean actual zero. With this in place: - Old userspace is guaranteed to carry weight_high of 0, therefore configuring 8-bit weights as appropriate. When dumping nexthops with 16-bit weight, it would only show the lower 8 bits. But configuring such nexthops implies existence of userspace aware of the extension in the first place. - New userspace talking to an old kernel will work as long as it only attempts to configure 8-bit weights, where the high-order bits are zero. Old kernel will bounce attempts at configuring >8-bit weights. Renaming reserved fields as they are allocated for some purpose is commonly done in Linux. Whoever touches a reserved field is doing so at their own risk. nexthop_grp::resvd1 in particular is currently used by at least strace, however they carry an own copy of UAPI headers, and the conversion should be trivial. A helper is provided for decoding the weight out of the two fields. Forcing a conversion seems preferable to bending backwards and introducing anonymous unions or whatever. The Linux kernel CVE team has assigned CVE-2024-14040 to this issue. Affected and fixed versions =========================== Fixed in 6.12 with commit b72a6a7ab9573e06d5c2fcb92eaa28614a735bfd Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-14040 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: include/net/nexthop.h include/uapi/linux/nexthop.h net/ipv4/nexthop.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/b72a6a7ab9573e06d5c2fcb92eaa28614a735bfd