{ "dataType": "CVE_RECORD", "cveMetadata": { "cveId": "CVE-2024-35853", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.106Z", "datePublished": "2024-05-17T14:47:30.109Z", "dateUpdated": "2024-08-02T03:21:48.394Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:30:09.181Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix memory leak during rehash\n\nThe rehash delayed work migrates filters from one region to another.\nThis is done by iterating over all chunks (all the filters with the same\npriority) in the region and in each chunk iterating over all the\nfilters.\n\nIf the migration fails, the code tries to migrate the filters back to\nthe old region. However, the rollback itself can also fail in which case\nanother migration will be erroneously performed. Besides the fact that\nthis ping pong is not a very good idea, it also creates a problem.\n\nEach virtual chunk references two chunks: The currently used one\n('vchunk->chunk') and a backup ('vchunk->chunk2'). During migration the\nfirst holds the chunk we want to migrate filters to and the second holds\nthe chunk we are migrating filters from.\n\nThe code currently assumes - but does not verify - that the backup chunk\ndoes not exist (NULL) if the currently used chunk does not reference the\ntarget region. This assumption breaks when we are trying to rollback a\nrollback, resulting in the backup chunk being overwritten and leaked\n[1].\n\nFix by not rolling back a failed rollback and add a warning to avoid\nfuture cases.\n\n[1]\nWARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20\nModules linked in:\nCPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G W 6.9.0-rc2-custom-00784-gc6a05c468a0b #14\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:parman_destroy+0x17/0x20\n[...]\nCall Trace:\n \n mlxsw_sp_acl_atcam_region_fini+0x19/0x60\n mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470\n process_one_work+0x151/0x370\n worker_thread+0x2cb/0x3e0\n kthread+0xd0/0x100\n ret_from_fork+0x34/0x50\n ret_from_fork_asm+0x1a/0x30\n " } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" ], "versions": [ { "version": "843500518509", "lessThan": "c6f3fa7f5a74", "status": "affected", "versionType": "git" }, { "version": "843500518509", "lessThan": "617e98ba4c50", "status": "affected", "versionType": "git" }, { "version": "843500518509", "lessThan": "413a01886c39", "status": "affected", "versionType": "git" }, { "version": "843500518509", "lessThan": "b822644fd909", "status": "affected", "versionType": "git" }, { "version": "843500518509", "lessThan": "0ae8ff7b6d42", "status": "affected", "versionType": "git" }, { "version": "843500518509", "lessThan": "b3fd51f684a0", "status": "affected", "versionType": "git" }, { "version": "843500518509", "lessThan": "8ca3f7a7b613", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" ], "versions": [ { "version": "5.1", "status": "affected" }, { "version": "0", "lessThan": "5.1", "status": "unaffected", "versionType": "custom" }, { "version": "5.4.275", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "custom" }, { "version": "5.10.216", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "custom" }, { "version": "5.15.158", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "custom" }, { "version": "6.1.90", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "custom" }, { "version": "6.6.30", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "custom" }, { "version": "6.8.9", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "custom" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/c6f3fa7f5a748bf6e5c4eb742686d6952f854e76" }, { "url": "https://git.kernel.org/stable/c/617e98ba4c50f4547c9eb0946b1cfc26937d70d1" }, { "url": "https://git.kernel.org/stable/c/413a01886c3958d4b8aac23a3bff3d430b92093e" }, { "url": "https://git.kernel.org/stable/c/b822644fd90992ee362c5e0c8d2556efc8856c76" }, { "url": "https://git.kernel.org/stable/c/0ae8ff7b6d42e33943af462910bdcfa2ec0cb8cf" }, { "url": "https://git.kernel.org/stable/c/b3fd51f684a0711504f82de510da109ae639722d" }, { "url": "https://git.kernel.org/stable/c/8ca3f7a7b61393804c46f170743c3b839df13977" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" } ], "title": "mlxsw: spectrum_acl_tcam: Fix memory leak during rehash", "x_generator": { "engine": "bippy-a5840b7849dd" } }, "adp": [ { "affected": [ { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*" ], "defaultStatus": "affected", "versions": [ { "version": "843500518509", "status": "affected", "lessThan": "c6f3fa7f5a74", "versionType": "git" }, { "version": "843500518509", "status": "affected", "lessThan": "617e98ba4c50", "versionType": "git" }, { "version": "843500518509", "status": "affected", "lessThan": "413a01886c39", "versionType": "git" }, { "version": "843500518509", "status": "affected", "lessThan": "b822644fd909", "versionType": "git" }, { "version": "843500518509", "status": "affected", "lessThan": "0ae8ff7b6d42", "versionType": "git" }, { "version": "843500518509", "status": "affected", "lessThan": "b3fd51f684a0", "versionType": "git" }, { "version": "843500518509", "status": "affected", "lessThan": "8ca3f7a7b613", "versionType": "git" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2024-05-20T17:34:35.252109Z", "id": "CVE-2024-35853", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-01T13:51:48.800Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:48.394Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/c6f3fa7f5a748bf6e5c4eb742686d6952f854e76", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/617e98ba4c50f4547c9eb0946b1cfc26937d70d1", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/413a01886c3958d4b8aac23a3bff3d430b92093e", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/b822644fd90992ee362c5e0c8d2556efc8856c76", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/0ae8ff7b6d42e33943af462910bdcfa2ec0cb8cf", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/b3fd51f684a0711504f82de510da109ae639722d", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/8ca3f7a7b61393804c46f170743c3b839df13977", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": [ "x_transferred" ] } ] } ] }, "dataVersion": "5.1" }