CVE-2024-35852

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35852
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work The rehash delayed work is rescheduled with a delay if the number of credits at end of the work is not negative as supposedly it means that the migration ended. Otherwise, it is rescheduled immediately. After "mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash" the above is no longer accurate as a non-negative number of credits is no longer indicative of the migration being done. It can also happen if the work encountered an error in which case the migration will resume the next time the work is scheduled. The significance of the above is that it is possible for the work to be pending and associated with hints that were allocated when the migration started. This leads to the hints being leaked [1] when the work is canceled while pending as part of ACL region dismantle. Fix by freeing the hints if hints are associated with a work that was canceled while pending. Blame the original commit since the reliance on not having a pending work associated with hints is fragile. [1] unreferenced object 0xffff88810e7c3000 (size 256): comm "kworker/0:16", pid 176, jiffies 4295460353 hex dump (first 32 bytes): 00 30 95 11 81 88 ff ff 61 00 00 00 00 00 00 80 .0......a....... 00 00 61 00 40 00 00 00 00 00 00 00 04 00 00 00 ..a.@........... backtrace (crc 2544ddb9): [<00000000cf8cfab3>] kmalloc_trace+0x23f/0x2a0 [<000000004d9a1ad9>] objagg_hints_get+0x42/0x390 [<000000000b143cf3>] mlxsw_sp_acl_erp_rehash_hints_get+0xca/0x400 [<0000000059bdb60a>] mlxsw_sp_acl_tcam_vregion_rehash_work+0x868/0x1160 [<00000000e81fd734>] process_one_work+0x59c/0xf20 [<00000000ceee9e81>] worker_thread+0x799/0x12c0 [<00000000bda6fe39>] kthread+0x246/0x300 [<0000000070056d23>] ret_from_fork+0x34/0x70 [<00000000dea2b93e>] ret_from_fork_asm+0x1a/0x30

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/51cefc9da400b953fee749c9e5d26cd4a2b5d758 Patch
https://git.kernel.org/stable/c/5bfe7bf9656ed2633718388f12b7c38b86414a04 Patch
https://git.kernel.org/stable/c/63d814d93c5cce4c18284adc810028f28dca493f Patch
https://git.kernel.org/stable/c/857ed800133ffcfcee28582090b63b0cbb8ba59d Patch
https://git.kernel.org/stable/c/d72dd6fcd7886d0523afbab8b4a4b22d17addd7d Patch
https://git.kernel.org/stable/c/de1aaefa75be9d0ec19c9a3e0e2f9696de20c6ab Patch
https://git.kernel.org/stable/c/fb4e2b70a7194b209fc7320bbf33b375f7114bd5 Patch
https://git.kernel.org/stable/c/51cefc9da400b953fee749c9e5d26cd4a2b5d758 Patch
https://git.kernel.org/stable/c/5bfe7bf9656ed2633718388f12b7c38b86414a04 Patch
https://git.kernel.org/stable/c/63d814d93c5cce4c18284adc810028f28dca493f Patch
https://git.kernel.org/stable/c/857ed800133ffcfcee28582090b63b0cbb8ba59d Patch
https://git.kernel.org/stable/c/d72dd6fcd7886d0523afbab8b4a4b22d17addd7d Patch
https://git.kernel.org/stable/c/de1aaefa75be9d0ec19c9a3e0e2f9696de20c6ab Patch
https://git.kernel.org/stable/c/fb4e2b70a7194b209fc7320bbf33b375f7114bd5 Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
History

30 Dec 2024, 18:11

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/51cefc9da400b953fee749c9e5d26cd4a2b5d758 - () https://git.kernel.org/stable/c/51cefc9da400b953fee749c9e5d26cd4a2b5d758 - Patch
References () https://git.kernel.org/stable/c/5bfe7bf9656ed2633718388f12b7c38b86414a04 - () https://git.kernel.org/stable/c/5bfe7bf9656ed2633718388f12b7c38b86414a04 - Patch
References () https://git.kernel.org/stable/c/63d814d93c5cce4c18284adc810028f28dca493f - () https://git.kernel.org/stable/c/63d814d93c5cce4c18284adc810028f28dca493f - Patch
References () https://git.kernel.org/stable/c/857ed800133ffcfcee28582090b63b0cbb8ba59d - () https://git.kernel.org/stable/c/857ed800133ffcfcee28582090b63b0cbb8ba59d - Patch
References () https://git.kernel.org/stable/c/d72dd6fcd7886d0523afbab8b4a4b22d17addd7d - () https://git.kernel.org/stable/c/d72dd6fcd7886d0523afbab8b4a4b22d17addd7d - Patch
References () https://git.kernel.org/stable/c/de1aaefa75be9d0ec19c9a3e0e2f9696de20c6ab - () https://git.kernel.org/stable/c/de1aaefa75be9d0ec19c9a3e0e2f9696de20c6ab - Patch
References () https://git.kernel.org/stable/c/fb4e2b70a7194b209fc7320bbf33b375f7114bd5 - () https://git.kernel.org/stable/c/fb4e2b70a7194b209fc7320bbf33b375f7114bd5 - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - Patch
CWE CWE-401
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Linux linux Kernel

21 Nov 2024, 09:21

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
References () https://git.kernel.org/stable/c/51cefc9da400b953fee749c9e5d26cd4a2b5d758 - () https://git.kernel.org/stable/c/51cefc9da400b953fee749c9e5d26cd4a2b5d758 -
References () https://git.kernel.org/stable/c/5bfe7bf9656ed2633718388f12b7c38b86414a04 - () https://git.kernel.org/stable/c/5bfe7bf9656ed2633718388f12b7c38b86414a04 -
References () https://git.kernel.org/stable/c/63d814d93c5cce4c18284adc810028f28dca493f - () https://git.kernel.org/stable/c/63d814d93c5cce4c18284adc810028f28dca493f -
References () https://git.kernel.org/stable/c/857ed800133ffcfcee28582090b63b0cbb8ba59d - () https://git.kernel.org/stable/c/857ed800133ffcfcee28582090b63b0cbb8ba59d -
References () https://git.kernel.org/stable/c/d72dd6fcd7886d0523afbab8b4a4b22d17addd7d - () https://git.kernel.org/stable/c/d72dd6fcd7886d0523afbab8b4a4b22d17addd7d -
References () https://git.kernel.org/stable/c/de1aaefa75be9d0ec19c9a3e0e2f9696de20c6ab - () https://git.kernel.org/stable/c/de1aaefa75be9d0ec19c9a3e0e2f9696de20c6ab -
References () https://git.kernel.org/stable/c/fb4e2b70a7194b209fc7320bbf33b375f7114bd5 - () https://git.kernel.org/stable/c/fb4e2b70a7194b209fc7320bbf33b375f7114bd5 -

05 Nov 2024, 10:16

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

25 Jun 2024, 21:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: mlxsw: espectro_acl_tcam: Corrige pérdida de memoria al cancelar trabajo de rehash El trabajo retrasado de rehash se reprograma con retraso si el número de créditos al final del trabajo no es negativo como supuestamente significa que la migración terminó. En caso contrario, se reprograma inmediatamente. Después de "mlxsw: espectro_acl_tcam: Corregir posible use after free durante la repetición", lo anterior ya no es exacto ya que una cantidad no negativa de créditos ya no es indicativo de la migración que se está realizando. También puede suceder si el trabajo encontró un error, en cuyo caso la migración se reanudará la próxima vez que se programe el trabajo. La importancia de lo anterior es que es posible que el trabajo esté pendiente y asociado con sugerencias que se asignaron cuando comenzó la migración. Esto lleva a que se filtren sugerencias [1] cuando el trabajo se cancela mientras está pendiente como parte del desmantelamiento de la región ACL. Se soluciona liberando las sugerencias si las sugerencias están asociadas con un trabajo que se canceló mientras estaba pendiente. Culpe al compromiso original, ya que la dependencia de no tener un trabajo pendiente asociado con sugerencias es frágil. [1] objeto sin referencia 0xffff88810e7c3000 (tamaño 256): comm "kworker/0:16", pid 176, jiffies 4295460353 volcado hexadecimal (primeros 32 bytes): 00 30 95 11 81 88 ff ff 61 00 00 00 00 00 80 . 0......a....... 00 00 61 00 40 00 00 00 00 00 00 00 04 00 00 00 ..a.@........... retroceso (crc 2544ddb9): [&lt;00000000cf8cfab3&gt;] kmalloc_trace+0x23f/0x2a0 [&lt;000000004d9a1ad9&gt;] objagg_hints_get+0x42/0x390 [&lt;000000000b143cf3&gt;] 0xca/0x400 [&lt;0000000059bdb60a&gt;] mlxsw_sp_acl_tcam_vregion_rehash_work+0x868/0x1160 [&lt;00000000e81fd734&gt;] proceso_one_work+ 0x59c/0xf20 [&lt;00000000ceee9e81&gt;] work_thread+0x799/0x12c0 [&lt;00000000bda6fe39&gt;] kthread+0x246/0x300 [&lt;0000000070056d23&gt;] ret_from_fork+0x34/0x70 [&lt;0000 0000dea2b93e&gt;] ret_from_fork_asm+0x1a/0x30
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -

17 May 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-17 15:15

Updated : 2024-12-30 18:11

NVD link : CVE-2024-35852

Mitre link : CVE-2024-35852

CVE.ORG link : CVE-2024-35852

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime