In the Linux kernel, the following vulnerability has been resolved:
bonding: stop the device in bond_setup_by_slave()
Commit 9eed321cde22 ("net: lapbether: only support ethernet devices") has been able to keep syzbot away from net/lapb, until today.
In the following splat [1], the issue is that a lapbether device has been created on a bonding device without members. Then adding a non ARPHRD_ETHER member forced the bonding master to change its type.
The fix is to make sure we call dev_close() in bond_setup_by_slave() so that the potential linked lapbether devices (or any other devices having assumptions on the physical device) are removed.
A similar bug has been addressed in commit 40baec225765 ("bonding: fix panic on non-ARPHRD_ETHER enslave failure")
[1] skbuff: skb_under_panic: text:ffff800089508810 len:44 put:40 head:ffff0000c78e7c00 data:ffff0000c78e7bea tail:0x16 end:0x140 dev:bond0 kernel BUG at net/core/skbuff.c:192 ! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6007 Comm: syz-executor383 Not tainted 6.6.0-rc3-syzkaller-gbf6547d8715b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic net/core/skbuff.c:188 [inline] pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202 lr : skb_panic net/core/skbuff.c:188 [inline] lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202 sp : ffff800096a06aa0 x29: ffff800096a06ab0 x28: ffff800096a06ba0 x27: dfff800000000000 x26: ffff0000ce9b9b50 x25: 0000000000000016 x24: ffff0000c78e7bea x23: ffff0000c78e7c00 x22: 000000000000002c x21: 0000000000000140 x20: 0000000000000028 x19: ffff800089508810 x18: ffff800096a06100 x17: 0000000000000000 x16: ffff80008a629a3c x15: 0000000000000001 x14: 1fffe00036837a32 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000201 x10: 0000000000000000 x9 : cb50b496c519aa00 x8 : cb50b496c519aa00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800096a063b8 x4 : ffff80008e280f80 x3 : ffff8000805ad11c x2 : 0000000000000001 x1 : 0000000100000201 x0 : 0000000000000086 Call trace: skb_panic net/core/skbuff.c:188 [inline] skb_under_panic+0x13c/0x140 net/core/skbuff.c:202 skb_push+0xf0/0x108 net/core/skbuff.c:2446 ip6gre_header+0xbc/0x738 net/ipv6/ip6_gre.c:1384 dev_hard_header include/linux/netdevice.h:3136 [inline] lapbeth_data_transmit+0x1c4/0x298 drivers/net/wan/lapbether.c:257 lapb_data_transmit+0x8c/0xb0 net/lapb/lapb_iface.c:447 lapb_transmit_buffer+0x178/0x204 net/lapb/lapb_out.c:149 lapb_send_control+0x220/0x320 net/lapb/lapb_subr.c:251 __lapb_disconnect_request+0x9c/0x17c net/lapb/lapb_iface.c:326 lapb_device_event+0x288/0x4e0 net/lapb/lapb_iface.c:492 notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 call_netdevice_notifiers_info net/core/dev.c:1970 [inline] call_netdevice_notifiers_extack net/core/dev.c:2008 [inline] call_netdevice_notifiers net/core/dev.c:2022 [inline] __dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508 dev_close_many+0x1e0/0x470 net/core/dev.c:1559 dev_close+0x174/0x250 net/core/dev.c:1585 lapbeth_device_event+0x2e4/0x958 drivers/net/wan/lapbether.c:466 notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 call_netdevice_notifiers_info net/core/dev.c:1970 [inline] call_netdevice_notifiers_extack net/core/dev.c:2008 [inline] call_netdevice_notifiers net/core/dev.c:2022 [inline] __dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508 dev_close_many+0x1e0/0x470 net/core/dev.c:1559 dev_close+0x174/0x250 net/core/dev.c:1585 bond_enslave+0x2298/0x30cc drivers/net/bonding/bond_main.c:2332 bond_do_ioctl+0x268/0xc64 drivers/net/bonding/bond_main.c:4539 dev_ifsioc+0x754/0x9ac dev_ioctl+0x4d8/0xd34 net/core/dev_ioctl.c:786 sock_do_ioctl+0x1d4/0x2d0 net/socket.c:1217 sock_ioctl+0x4e8/0x834 net/socket.c:1322 vfs_ioctl fs/ioctl.c:51 [inline] __do_ ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-cross-headersUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-coreUpgrade kernel-rt-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-develUpgrade kernel-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-debugUpgrade kernel-headersUpgrade kernel-zfcpdump-develUpgrade kernel-rt-kvmUpgrade kernel-toolsUpgrade kernel-rt-debug-modules-extraUpgrade bpftoolUpgrade kernel-tools-libs-develUpgrade kernel-rtUpgrade python3-perfUpgrade kernel-zfcpdumpUpgrade kernel-docUpgrade kernel-rt-debugUpgrade kernel-rt-debug-modulesUpgrade kernel-develUpgrade kernel-rt-develUpgrade kernel-rt-modulesUpgrade perfUpgrade kernel-zfcpdump-core | Aug 12, 2024 | May 21, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade perfUpgrade kernel-toolsUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.15.145-95.156Upgrade kernelUpgrade kernel-livepatch-5.10.205-195.804Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade python-perfUpgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-4.14.355-276.639Upgrade kernel-devel | Jun 26, 2024 | May 21, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-6.1.66-91.160Upgrade perf-debuginfoUpgrade perfUpgrade python3-perfUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade kernel-libbpfUpgrade kernel-tools-develUpgrade kernel-modules-extraUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade kernelUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-develUpgrade kernel-libbpf-develUpgrade kernel-toolsUpgrade python3-perf-debuginfo | Feb 17, 2025 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-abi-stablelists | Oct 9, 2024 | May 21, 2024 |
| Oracle_linux | — | Upgrade kernel | Aug 16, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Aug 12, 2024 | May 21, 2024 |
| Rocky_linux | — | Upgrade kernel-toolsUpgrade kernel-rt-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debug-coreUpgrade kernel-rt-kvmUpgrade bpftoolUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-rtUpgrade kernel-tools-libs-develUpgrade perfUpgrade kernelUpgrade kernel-cross-headersUpgrade kernel-rt-debuginfoUpgrade kernel-tools-libsUpgrade kernel-debug-debuginfoUpgrade kernel-debug-coreUpgrade python3-perfUpgrade kernel-rt-debugUpgrade kernel-debugUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade python3-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-develUpgrade kernel-rt-develUpgrade kernel-rt-coreUpgrade kernel-modules-extraUpgrade kernel-develUpgrade kernel-modulesUpgrade kernel-debuginfo | Aug 22, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-rt_debug-livepatch-develUpgrade gfs2-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-rt-livepatchUpgrade gfs2-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-default-baseUpgrade dtb-exynosUpgrade dtb-renesasUpgrade reiserfs-kmp-defaultUpgrade kernel-default-optionalUpgrade dtb-apmUpgrade dtb-xilinxUpgrade kernel-debugUpgrade kernel-64kb-develUpgrade kernel-default-extraUpgrade kernel-default-vdsoUpgrade kernel-rt-develUpgrade kernel-64kbUpgrade kernel-64kb-optionalUpgrade kernel-devel-rtUpgrade dtb-armUpgrade kernel-sourceUpgrade kernel-default-livepatch-develUpgrade kernel-develUpgrade kernel-zfcpdumpUpgrade dtb-mediatekUpgrade kernel-64kb-livepatch-develUpgrade cluster-md-kmp-azureUpgrade kernel-obs-qaUpgrade kernel-symsUpgrade dtb-amdUpgrade reiserfs-kmp-azureUpgrade dtb-caviumUpgrade kselftests-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade kernel-docsUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-azureUpgrade dtb-hisiliconUpgrade cluster-md-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade dtb-allwinnerUpgrade dlm-kmp-azureUpgrade kernel-debug-vdsoUpgrade kselftests-kmp-rtUpgrade kernel-source-vanillaUpgrade kernel-devel-azureUpgrade dtb-qcomUpgrade dtb-amazonUpgrade kselftests-kmp-64kbUpgrade kernel-obs-buildUpgrade reiserfs-kmp-64kbUpgrade dtb-socionextUpgrade dlm-kmp-64kbUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-azureUpgrade dtb-broadcomUpgrade kernel-azure-extraUpgrade kernel-64kb-extraUpgrade dtb-sprdUpgrade kernel-docs-htmlUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-baseUpgrade gfs2-kmp-defaultUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-manUpgrade dtb-lgUpgrade dtb-freescaleUpgrade kernel-syms-azureUpgrade kernel-rtUpgrade kernel-rt_debug-develUpgrade kernel-azure-develUpgrade dtb-nvidiaUpgrade dtb-marvellUpgrade kernel-azure-livepatch-develUpgrade kernel-rt_debugUpgrade kernel-azure-optionalUpgrade dtb-rockchipUpgrade kernel-rt-vdsoUpgrade kernel-default-base-rebuildUpgrade kernel-defaultUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-azureUpgrade kernel-kvmsmallUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-develUpgrade kernel-source-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-source-rtUpgrade kernel-default-livepatchUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-azureUpgrade dtb-appleUpgrade dtb-amlogicUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-rt-extraUpgrade dtb-alteraUpgrade kernel-macros | Jul 10, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-ibm-5.15Upgrade linux-nvidia-tegra-igxUpgrade linux-riscv-5.15Upgrade linux-oracle-5.4Upgrade linuxUpgrade linux-gkeopUpgrade linux-oracle-5.15Upgrade linux-nvidia-tegra-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-nvidia-tegraUpgrade linux-azure-fipsUpgrade linux-ibm-5.4Upgrade linux-hwe-5.4Upgrade linux-fipsUpgrade linux-aws-fipsUpgrade linux-gcpUpgrade linux-gkeUpgrade linux-gcp-fipsUpgrade linux-gcp-5.4Upgrade linux-awsUpgrade linux-lowlatencyUpgrade linux-realtimeUpgrade linux-gkeop-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-azureUpgrade linux-iotUpgrade linux-oracleUpgrade linux-nvidia-6.5Upgrade linux-lowlatency-hwe-5.15Upgrade linux-hwe-5.15Upgrade linux-ibmUpgrade linux-nvidiaUpgrade linux-aws-5.4Upgrade linux-intel-iotgUpgrade linux-aws-5.15Upgrade linux-bluefieldUpgrade linux-azure-5.4Upgrade linux-raspi-5.4Upgrade linux-azure-5.15Upgrade linux-xilinx-zynqmpUpgrade linux-kvmUpgrade linux-azure-fdeUpgrade linux-raspiUpgrade linux-gcp-5.15 | Nov 19, 2024 | May 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub