CVE-2024-42073: mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems
In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrumbuffers: Fix memory corruptions on Spectrum-4 systems
The following two shared buffer operations make use of the Shared Buffer Status Register (SBSR):
# devlink sb occupancy snapshot pci/0000:01:00.0 # devlink sb occupancy clearmax pci/0000:01:00.0
The register has two masks of 256 bits to denote on which ingress / egress ports the register should operate on. Spectrum-4 has more than 256 ports, so the register was extended by cited commit with a new 'portpage' field.
However, when filling the register's payload, the driver specifies the ports as absolute numbers and not relative to the first port of the port page, resulting in memory corruptions [1].
Fix by specifying the ports relative to the first port of the port page.
[1] BUG: KASAN: slab-use-after-free in mlxswspsboccsnapshot+0xb6d/0xbc0 Read of size 1 at addr ffff8881068cb00f by task devlink/1566 [...] Call Trace: <TASK> dumpstacklvl+0xc6/0x120 printreport+0xce/0x670 kasanreport+0xd7/0x110 mlxswspsboccsnapshot+0xb6d/0xbc0 mlxswdevlinksboccsnapshot+0x75/0xb0 devlinknlsboccsnapshotdoit+0x1f9/0x2a0 genlfamilyrcvmsgdoit+0x20c/0x300 genlrcvmsg+0x567/0x800 netlinkrcvskb+0x170/0x450 genlrcv+0x2d/0x40 netlinkunicast+0x547/0x830 netlinksendmsg+0x8d4/0xdb0 syssendto+0x49b/0x510 x64syssendto+0xe5/0x1c0 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f [...] Allocated by task 1: kasansavestack+0x33/0x60 kasansavetrack+0x14/0x30 kasankmalloc+0x8f/0xa0 copyverifierstate+0xbc2/0xfb0 docheckcommon+0x2c51/0xc7e0 bpfcheck+0x5107/0x9960 bpfprogload+0xf0e/0x2690 sysbpf+0x1a61/0x49d0 x64sysbpf+0x7d/0xc0 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f
Freed by task 1: kasansavestack+0x33/0x60 kasansavetrack+0x14/0x30 kasansavefreeinfo+0x3b/0x60 poisonslabobject+0x109/0x170 kasanslabfree+0x14/0x30 kfree+0xca/0x2b0 freeverifierstate+0xce/0x270 docheckcommon+0x4828/0xc7e0 bpfcheck+0x5107/0x9960 bpfprogload+0xf0e/0x2690 sysbpf+0x1a61/0x49d0 x64sysbpf+0x7d/0xc0 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42073?
CVE-2024-42073 has been classified as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-42073?
To fix CVE-2024-42073, update to the recommended Linux kernel versions listed in your package manager or source repository.
Which versions of the Linux kernel are affected by CVE-2024-42073?
CVE-2024-42073 affects Linux kernel versions prior to 5.10.223, 6.1.123, 6.12.11, and also specific versions between 6.2 and 6.9.8.
What systems are impacted by CVE-2024-42073?
CVE-2024-42073 specifically impacts Spectrum-4 systems utilizing the Linux kernel.
What type of vulnerability is CVE-2024-42073?
CVE-2024-42073 is a memory corruption vulnerability that affects shared buffer operations in the Linux kernel.