CVE-2024-26953: net: esp: fix bad handling of pages from page_pool
In the Linux kernel, the following vulnerability has been resolved:
net: esp: fix bad handling of pages from pagepool
The Linux kernel CVE team has assigned CVE-2024-26953 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050128-CVE-2024-26953-8304@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net: esp: fix bad handling of pages from pagepool
When the skb is reorganized during espoutput (!esp->inline), the pages coming from the original skb fragments are supposed to be released back to the system through putpage. But if the skb fragment pages are originating from a pagepool, calling putpage on them will trigger a pagepool leak which will eventually result in a crash.
This leak can be easily observed when using CONFIGDEBUGVM and doing ipsec + gre (non offloaded) forwarding:
BUG: Bad page state in process ksoftirqd/16 pfn:1451b6 page:00000000de2b8d32 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1451b6000 pfn:0x1451b6 flags: 0x200000000000000(node=0|zone=2) pagetype: 0xffffffff() raw: 0200000000000000 dead000000000040 ffff88810d23c000 0000000000000000 raw: 00000001451b6000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: pagepool leak Modules linked in: ipgre gre mlx5ib mlx5core xtconntrack xtMASQUERADE nfconntracknetlink nfnetlink iptablenat nfnat xtaddrtype brnetfilter rpcrdma rdmaucm ibiser libiscsi scsitransportiscsi ibumad rdmacm ibipoib iwcm ibcm ibuverbs ibcore overlay zram zsmalloc fuse [last unloaded: mlx5core] CPU: 16 PID: 96 Comm: ksoftirqd/16 Not tainted 6.8.0-rc4+ #22 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dumpstacklvl+0x36/0x50 badpage+0x70/0xf0 freeunrefpageprepare+0x27a/0x460 freeunrefpage+0x38/0x120 espssgunref.isra.0+0x15f/0x200 espoutputtail+0x66d/0x780 espxmit+0x2c5/0x360 validatexmitxfrm+0x313/0x370 ? validatexmitskb+0x1d/0x330 validatexmitskblist+0x4c/0x70 schdirectxmit+0x23e/0x350 devqueuexmit+0x337/0xba0 ? nfhookslow+0x3f/0xd0 ipfinishoutput2+0x25e/0x580 iptunnelxmit+0x19b/0x240 iptunnelxmit+0x5fb/0xb60 ipgrexmit+0x14d/0x280 [ipgre] devhardstartxmit+0xc3/0x1c0 devqueuexmit+0x208/0xba0 ? nfhookslow+0x3f/0xd0 ipfinishoutput2+0x1ca/0x580 ipsublistrcvfinish+0x32/0x40 ipsublistrcv+0x1b2/0x1f0 ? iprcvfinishcore.constprop.0+0x460/0x460 iplistrcv+0x103/0x130 netifreceiveskblistcore+0x181/0x1e0 netifreceiveskblistinternal+0x1b3/0x2c0 napigroreceive+0xc8/0x200 grocellpoll+0x52/0x90 napipoll+0x25/0x1a0 netrxaction+0x28e/0x300 dosoftirq+0xc3/0x276 ? sortrange+0x20/0x20 runksoftirqd+0x1e/0x30 smpbootthreadfn+0xa6/0x130 kthread+0xcd/0x100 ? kthreadcompleteandexit+0x20/0x20 retfromfork+0x31/0x50 ? kthreadcompleteandexit+0x20/0x20 retfromforkasm+0x11/0x20 </TASK>
The suggested fix is to introduce a new wrapper (skbpageunref) that covers page refcounting for pagepool pages as well.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.12.21-1Fixed in 6.12.22-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.24 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.12 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.3 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2024-26953 - Configuration
Apply the upstream net: esp fix: during esp_output (!esp->inline) skb reorganization, release original skb fragment pages using the new skb_page_unref wrapper (covers page refcounting for page_pool pages); this prevents page_pool leaks that lead to a crash (CVE-2024-26953).
Linux kernel networking (net: esp) Page refcounting behavior for skb fragment pages from page_pool = Use skb_page_unref wrapper instead of calling put_page so page_pool pages are released with correct refcounting - Compensating control
As a mitigation to observe/trigger and validate the leak condition, use CONFIG_DEBUG_VM and run ipsec + gre forwarding (non offloaded) as described; avoid this workload on affected kernels if it can reproduce the page_pool leak/crash.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26953?
CVE-2024-26953 is categorized with a high severity rating due to its impact on the Linux kernel's handling of pages.
What versions of the Linux kernel are affected by CVE-2024-26953?
CVE-2024-26953 affects Linux kernel versions prior to 6.6.24, 6.7.12, 6.8.3, and 6.9 on Red Hat, as well as specific versions on Debian.
How do I fix CVE-2024-26953?
To fix CVE-2024-26953, update the Linux kernel to the remedied versions specified for your distribution.
Is CVE-2024-26953 being actively exploited?
As of now, there is no public indication that CVE-2024-26953 is being actively exploited in the wild.
What are the recommended mitigation strategies for CVE-2024-26953?
The primary mitigation strategy for CVE-2024-26953 is to ensure timely updates to the kernel to the latest secure versions.