CVE-2024-56588: scsi: hisi_sas: Create all dump files during debugfs initialization
In the Linux kernel, the following vulnerability has been resolved:
scsi: hisisas: Create all dump files during debugfs initialization
For the current debugfs of hisisas, after user triggers dump, the driver allocate memory space to save the register information and create debugfs files to display the saved information. In this process, the debugfs files created after each dump.
Therefore, when the dump is triggered while the driver is unbind, the following hang occurs:
[67840.853907] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0 [67840.862947] Mem abort info: [67840.865855] ESR = 0x0000000096000004 [67840.869713] EC = 0x25: DABT (current EL), IL = 32 bits [67840.875125] SET = 0, FnV = 0 [67840.878291] EA = 0, S1PTW = 0 [67840.881545] FSC = 0x04: level 0 translation fault [67840.886528] Data abort info: [67840.889524] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [67840.895117] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [67840.900284] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [67840.905709] user pgtable: 4k pages, 48-bit VAs, pgdp=0000002803a1f000 [67840.912263] [00000000000000a0] pgd=0000000000000000, p4d=0000000000000000 [67840.919177] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [67840.996435] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [67841.003628] pc : downwrite+0x30/0x98 [67841.007546] lr : startcreating.part.0+0x60/0x198 [67841.012495] sp : ffff8000b979ba20 [67841.016046] x29: ffff8000b979ba20 x28: 0000000000000010 x27: 0000000000024b40 [67841.023412] x26: 0000000000000012 x25: ffff20202b355ae8 x24: ffff20202b35a8c8 [67841.030779] x23: ffffa36877928208 x22: ffffa368b4972240 x21: ffff8000b979bb18 [67841.038147] x20: ffff00281dc1e3c0 x19: fffffffffffffffe x18: 0000000000000020 [67841.045515] x17: 0000000000000000 x16: ffffa368b128a530 x15: ffffffffffffffff [67841.052888] x14: ffff8000b979bc18 x13: ffffffffffffffff x12: ffff8000b979bb18 [67841.060263] x11: 0000000000000000 x10: 0000000000000000 x9 : ffffa368b1289b18 [67841.067640] x8 : 0000000000000012 x7 : 0000000000000000 x6 : 00000000000003a9 [67841.075014] x5 : 0000000000000000 x4 : ffff002818c5cb00 x3 : 0000000000000001 [67841.082388] x2 : 0000000000000000 x1 : ffff002818c5cb00 x0 : 00000000000000a0 [67841.089759] Call trace: [67841.092456] downwrite+0x30/0x98 [67841.096017] startcreating.part.0+0x60/0x198 [67841.100613] debugfscreatedir+0x48/0x1f8 [67841.104950] debugfscreatefilesv3hw+0x88/0x348 [hisisasv3hw] [67841.111447] debugfssnapshotregsv3hw+0x708/0x798 [hisisasv3hw] [67841.118111] debugfstriggerdumpv3hwwrite+0x9c/0x120 [hisisasv3hw] [67841.125115] fullproxywrite+0x68/0xc8 [67841.129175] vfswrite+0xd8/0x3f0 [67841.132708] ksyswrite+0x70/0x108 [67841.136317] arm64syswrite+0x24/0x38 [67841.140440] invokesyscall+0x50/0x128 [67841.144385] el0svccommon.constprop.0+0xc8/0xf0 [67841.149273] doel0svc+0x24/0x38 [67841.152773] el0svc+0x38/0xd8 [67841.156009] el0t64synchandler+0xc0/0xc8 [67841.160361] el0t64sync+0x1a4/0x1a8 [67841.164189] Code: b9000882 d2800002 d2800023 f9800011 (c85ffc05) [67841.170443] ---[ end trace 0000000000000000 ]---
To fix this issue, create all directories and files during debugfs initialization. In this way, the driver only needs to allocate memory space to save information each time the user triggers dumping.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56588?
CVE-2024-56588 has a severity rating that requires immediate attention due to potential memory allocation issues during debugfs initialization.
How do I fix CVE-2024-56588?
To fix CVE-2024-56588, upgrade your Linux kernel version to at least 6.12.5 or later.
What systems are affected by CVE-2024-56588?
CVE-2024-56588 affects systems running vulnerable versions of the Linux kernel prior to 6.12.5.
What mitigation measures can be taken for CVE-2024-56588?
Users can mitigate CVE-2024-56588 by disabling the hisi_sas driver if the debugfs functionality is not needed.
Is there a patch for CVE-2024-56588?
Yes, a patch for CVE-2024-56588 is included in the updates for the Linux kernel version 6.12.5 and later.