CVE-2024-26707: net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
In the Linux kernel, the following vulnerability has been resolved:
net: hsr: remove WARNONCE() in sendhsrsupervisionframe()
Syzkaller reported [1] hitting a warning after failing to allocate resources for skb in hsrinitskb(). Since a WARNONCE() call will not help much in this case, it might be prudent to switch to netdevwarnonce(). At the very least it will suppress syzkaller reports such as [1].
Just in case, use netdevwarnonce() in sendprpsupervisionframe() for similar reasons.
[1] HSR: Could not send supervision frame WARNING: CPU: 1 PID: 85 at net/hsr/hsrdevice.c:294 sendhsrsupervisionframe+0x60a/0x810 net/hsr/hsrdevice.c:294 RIP: 0010:sendhsrsupervisionframe+0x60a/0x810 net/hsr/hsrdevice.c:294 ... Call Trace: <IRQ> hsrannounce+0x114/0x370 net/hsr/hsrdevice.c:382 calltimerfn+0x193/0x590 kernel/time/timer.c:1700 expiretimers kernel/time/timer.c:1751 [inline] runtimers+0x764/0xb20 kernel/time/timer.c:2022 runtimersoftirq+0x58/0xd0 kernel/time/timer.c:2035 dosoftirq+0x21a/0x8de kernel/softirq.c:553 invokesoftirq kernel/softirq.c:427 [inline] irqexitrcu kernel/softirq.c:632 [inline] irqexitrcu+0xb7/0x120 kernel/softirq.c:644 sysvecapictimerinterrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076 </IRQ> <TASK> asmsysvecapictimerinterrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649 ...
This issue is also found in older kernels (at least up to 5.10).
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net: hsr: remove WARNONCE() in sendhsrsupervisionframe()
The Linux kernel CVE team has assigned CVE-2024-26707 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040341-CVE-2024-26707-1153@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26707?
CVE-2024-26707 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-26707?
To mitigate CVE-2024-26707, upgrade the Linux kernel to versions 5.10.210, 5.15.149, 6.1.79, 6.6.18, 6.7.6, 6.8 or later as recommended.
Which systems are affected by CVE-2024-26707?
CVE-2024-26707 affects various systems running specific versions of the Linux kernel, including those from Red Hat and Debian.
What are the impacts of CVE-2024-26707?
The impact of CVE-2024-26707 involves potential issues in resource allocation for socket buffers, which could affect network performance.
Is CVE-2024-26707 exploitable remotely?
CVE-2024-26707 does not indicate that it is directly exploitable remotely but may affect the stability of affected systems.