CVE-2024-57795: RDMA/rxe: Remove the direct link to net_device
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Remove the direct link to netdevice
The similar patch in siw is in the link: https://git.kernel.org/rdma/rdma/c/16b87037b48889
This problem also occurred in RXE. The following analyze this problem. In the following Call Traces: " BUG: KASAN: slab-use-after-free in devgetflags+0x188/0x1d0 net/core/dev.c:8782 Read of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295
CPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: infiniband ibcacheeventtask Call Trace: <TASK> dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:377 [inline] printreport+0x169/0x550 mm/kasan/report.c:488 kasanreport+0x143/0x180 mm/kasan/report.c:601 devgetflags+0x188/0x1d0 net/core/dev.c:8782 rxequeryport+0x12d/0x260 drivers/infiniband/sw/rxe/rxeverbs.c:60 ibqueryport drivers/infiniband/core/device.c:2111 [inline] ibqueryport+0x168/0x7d0 drivers/infiniband/core/device.c:2143 ibcacheupdate+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494 ibcacheeventtask+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568 processonework kernel/workqueue.c:3229 [inline] processscheduledworks+0xa65/0x1850 kernel/workqueue.c:3310 workerthread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 retfromfork+0x4d/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x1a/0x30 arch/x86/entry/entry64.S:244 </TASK> "
1). In the link [1],
" infiniband syz2: set down "
This means that on 839.350575, the event ibcacheeventtask was sent andi queued in ibwq.
2). In the link [1],
" team0 (unregistering): Port device teamslave0 removed "
It indicates that before 843.251853, the net device should be freed.
3). In the link [1],
" BUG: KASAN: slab-use-after-free in devgetflags+0x188/0x1d0 "
This means that on 850.559070, this slab-use-after-free problem occurred.
In all, on 839.350575, the event ibcacheeventtask was sent and queued in ibwq,
before 843.251853, the net device veth was freed.
on 850.559070, this event was executed, and the mentioned freed net device was called. Thus, the above call trace occurred.
[1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.27-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 16b87037b48889
Event History
Frequently Asked Questions
What is the severity of CVE-2024-57795?
CVE-2024-57795 has been classified as a medium-severity vulnerability in the Linux kernel.
How do I fix CVE-2024-57795?
To resolve CVE-2024-57795, update your Linux kernel to the latest version where the vulnerability has been patched.
What systems are affected by CVE-2024-57795?
CVE-2024-57795 affects the Linux kernel, particularly systems utilizing RDMA functionality.
What does CVE-2024-57795 exploit?
CVE-2024-57795 exploits an issue with the direct link to net_device in the RDMA/rxe subsystem of the Linux kernel.
Are there any known exploits for CVE-2024-57795?
As of now, there are no publicly available exploits for CVE-2024-57795, but it is advised to patch systems promptly.