CVE-2024-46857

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-46857
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix bridge mode operations when there are no VFs Currently, trying to set the bridge mode attribute when numvfs=0 leads to a crash: bridge link set dev eth2 hwmode vepa [ 168.967392] BUG: kernel NULL pointer dereference, address: 0000000000000030 [...] [ 168.969989] RIP: 0010:mlx5_add_flow_rules+0x1f/0x300 [mlx5_core] [...] [ 168.976037] Call Trace: [ 168.976188] <TASK> [ 168.978620] _mlx5_eswitch_set_vepa_locked+0x113/0x230 [mlx5_core] [ 168.979074] mlx5_eswitch_set_vepa+0x7f/0xa0 [mlx5_core] [ 168.979471] rtnl_bridge_setlink+0xe9/0x1f0 [ 168.979714] rtnetlink_rcv_msg+0x159/0x400 [ 168.980451] netlink_rcv_skb+0x54/0x100 [ 168.980675] netlink_unicast+0x241/0x360 [ 168.980918] netlink_sendmsg+0x1f6/0x430 [ 168.981162] ____sys_sendmsg+0x3bb/0x3f0 [ 168.982155] ___sys_sendmsg+0x88/0xd0 [ 168.985036] __sys_sendmsg+0x59/0xa0 [ 168.985477] do_syscall_64+0x79/0x150 [ 168.987273] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 168.987773] RIP: 0033:0x7f8f7950f917 (esw->fdb_table.legacy.vepa_fdb is null) The bridge mode is only relevant when there are multiple functions per port. Therefore, prevent setting and getting this setting when there are no VFs. Note that after this change, there are no settings to change on the PF interface using `bridge link` when there are no VFs, so the interface no longer appears in the `bridge link` output.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/505ae01f75f839b54329164bbfecf24cc1361b31 Patch
https://git.kernel.org/stable/c/52c4beb79e095e0631b5cac46ed48a2aefe51985 Patch
https://git.kernel.org/stable/c/65feee671e37f3b6eda0b6af28f204b5bcf7fa50 Patch
https://git.kernel.org/stable/c/b1d305abef4640af1b4f1b4774d513cd81b10cfc Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*
History

01 Oct 2024, 17:10

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*

01 Oct 2024, 16:00

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/505ae01f75f839b54329164bbfecf24cc1361b31 - () https://git.kernel.org/stable/c/505ae01f75f839b54329164bbfecf24cc1361b31 - Patch
References () https://git.kernel.org/stable/c/52c4beb79e095e0631b5cac46ed48a2aefe51985 - () https://git.kernel.org/stable/c/52c4beb79e095e0631b5cac46ed48a2aefe51985 - Patch
References () https://git.kernel.org/stable/c/65feee671e37f3b6eda0b6af28f204b5bcf7fa50 - () https://git.kernel.org/stable/c/65feee671e37f3b6eda0b6af28f204b5bcf7fa50 - Patch
References () https://git.kernel.org/stable/c/b1d305abef4640af1b4f1b4774d513cd81b10cfc - () https://git.kernel.org/stable/c/b1d305abef4640af1b4f1b4774d513cd81b10cfc - Patch
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-476

30 Sep 2024, 12:45

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5: Corregir operaciones en modo puente cuando no hay VF Actualmente, intentar establecer el atributo de modo puente cuando numvfs=0 provoca un bloqueo: bridge link set dev eth2 hwmode vepa [ 168.967392] ERROR: desreferencia de puntero NULL del kernel, dirección: 0000000000000030 [...] [ 168.969989] RIP: 0010:mlx5_add_flow_rules+0x1f/0x300 [mlx5_core] [...] [ 168.976037] Seguimiento de llamadas: [ 168.976188] [ 168.978620] _mlx5_eswitch_set_vepa_locked+0x113/0x230 [mlx5_core] [ 168.979074] mlx5_eswitch_set_vepa+0x7f/0xa0 [mlx5_core] [ 168.979471] rtnl_bridge_setlink+0xe9/0x1f0 [ 168.979714] rtnetlink_rcv_msg+0x159/0x400 [ 168.980451] netlink_rcv_skb+0x54/0x100 [ 168.980675] netlink_unicast+0x241/0x360 [ 168.980918] netlink_sendmsg+0x1f6/0x430 [ 168.981162] ____sys_sendmsg+0x3bb/0x3f0 [ 168.982155] ___sys_sendmsg+0x88/0xd0 [ 168.985036] __sys_sendmsg+0x59/0xa0 [ 168.985477] do_syscall_64+0x79/0x150 [ 168.987273] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 168.987773] RIP: 0033:0x7f8f7950f917 (esw-&gt;fdb_table.legacy.vepa_fdb es nulo) El modo puente solo es relevante cuando hay varias funciones por puerto. Por lo tanto, evite configurar y obtener esta configuración cuando no haya VF. Tenga en cuenta que después de este cambio, no hay configuraciones para cambiar en la interfaz PF usando "enlace de puente" cuando no hay VF, por lo que la interfaz ya no aparece en la salida del "enlace de puente".

27 Sep 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-27 13:15

Updated : 2024-10-01 17:10

NVD link : CVE-2024-46857

Mitre link : CVE-2024-46857

CVE.ORG link : CVE-2024-46857

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference