In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_acl_tcam: Fix stack corruption
When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a list of ACLs. In turn, each ACL points to a different TCAM region where the filters are stored. During forwarding, the ACLs are sequentially evaluated until a match is found.
One reason to place filters in different regions is when they are added with decreasing priorities and in an alternating order so that two consecutive filters can never fit in the same region because of their key usage.
In Spectrum-2 and newer ASICs the firmware started to report that the maximum number of ACLs in a group is more than 16, but the layout of the register that configures ACL groups (PAGT) was not updated to account for that. It is therefore possible to hit stack corruption [1] in the rare case where more than 16 ACLs in a group are required.
Fix by limiting the maximum ACL group size to the minimum between what the firmware reports and the maximum ACLs that fit in the PAGT register.
Add a test case to make sure the machine does not crash when this condition is hit.
[1] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: mlxsw_sp_acl_tcam_group_update+0x116/0x120 [...] dump_stack_lvl+0x36/0x50 panic+0x305/0x330 __stack_chk_fail+0x15/0x20 mlxsw_sp_acl_tcam_group_update+0x116/0x120 mlxsw_sp_acl_tcam_group_region_attach+0x69/0x110 mlxsw_sp_acl_tcam_vchunk_get+0x492/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade kernel-uki-virtUpgrade kernel-rt-modules-coreUpgrade kernel-modules-extraUpgrade kernel-toolsUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-tools-libsUpgrade rvUpgrade kernel-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-64k-debugUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-abi-stablelistsUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modulesUpgrade kernel-docUpgrade kernel-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rtUpgrade kernel-64k-coreUpgrade kernel-rt-kvmUpgrade python3-perfUpgrade kernel-64k-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-64k-modulesUpgrade kernel-develUpgrade kernel-64k-debug-develUpgrade kernel-rt-modules-extraUpgrade kernel-modules-coreUpgrade libperfUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-develUpgrade perfUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-develUpgrade kernel-rt-coreUpgrade kernel-debug-coreUpgrade kernel-64k-develUpgrade kernel-rt-develUpgrade rtlaUpgrade kernel-headersUpgrade kernel-64k-debug-coreUpgrade kernel-rt-debugUpgrade kernel-64k-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-debugUpgrade kernel-debug-develUpgrade kernelUpgrade kernel-64kUpgrade kernel-debug-uki-virtUpgrade bpftool | Aug 12, 2024 | Feb 22, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade python-perf-debuginfoUpgrade perfUpgrade kernel-headersUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade python-perfUpgrade kernel-tools-develUpgrade kernel-livepatch-5.15.148-97.158Upgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.10.209-198.812Upgrade bpftoolUpgrade kernel-toolsUpgrade kernel | May 13, 2024 | Feb 22, 2024 |
| Debian | — | Upgrade linux | Jun 27, 2024 | Feb 22, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libs | May 13, 2024 | Feb 22, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Jun 3, 2024 | Feb 22, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade kernel-abi-stablelists | Jul 1, 2024 | Feb 22, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernelUpgrade python3-perf | Jul 17, 2024 | Feb 22, 2024 |
| Oracle_linux | — | Upgrade kernel | May 14, 2024 | Feb 22, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Apr 19, 2024 | Feb 22, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-coreUpgrade python3-perf-debuginfoUpgrade kernelUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-coreUpgrade bpftool-debuginfoUpgrade kernel-cross-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rtUpgrade kernel-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-rt-develUpgrade kernel-rt-debugUpgrade kernel-rt-coreUpgrade perf-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-toolsUpgrade kernel-debug-coreUpgrade kernel-debug-develUpgrade kernel-debugUpgrade kernel-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-kvmUpgrade bpftoolUpgrade perfUpgrade kernel-develUpgrade kernel-debuginfoUpgrade python3-perf | Aug 22, 2024 | Feb 22, 2024 |
| Suse | — | Upgrade kernel-default-livepatch-develUpgrade kernel-rt-develUpgrade kernel-rt-extraUpgrade kernel-rt-livepatchUpgrade kernel-64kb-optionalUpgrade kernel-defaultUpgrade kernel-source-rtUpgrade dlm-kmp-defaultUpgrade dtb-hisiliconUpgrade dtb-renesasUpgrade gfs2-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-devel-rtUpgrade kselftests-kmp-azureUpgrade kernel-rt-optionalUpgrade gfs2-kmp-azureUpgrade kernel-develUpgrade dtb-mediatekUpgrade kernel-rt_debug-develUpgrade ocfs2-kmp-azureUpgrade reiserfs-kmp-rtUpgrade kernel-obs-buildUpgrade dtb-alteraUpgrade dtb-caviumUpgrade kernel-64kb-develUpgrade cluster-md-kmp-64kbUpgrade kernel-64kb-extraUpgrade dtb-amdUpgrade dtb-sprdUpgrade kernel-default-optionalUpgrade kernel-azureUpgrade kernel-azure-extraUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-livepatchUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-rtUpgrade kernel-azure-optionalUpgrade kselftests-kmp-rtUpgrade kernel-debug-develUpgrade dlm-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade dtb-allwinnerUpgrade dtb-appleUpgrade kernel-default-baseUpgrade ocfs2-kmp-defaultUpgrade dtb-socionextUpgrade kernel-debugUpgrade dtb-nvidiaUpgrade kernel-debug-vdsoUpgrade dtb-xilinxUpgrade kernel-docsUpgrade reiserfs-kmp-defaultUpgrade kernel-preempt-develUpgrade kernel-rt_debugUpgrade kernel-preemptUpgrade kernel-64kbUpgrade dtb-lgUpgrade dtb-amazonUpgrade kselftests-kmp-64kbUpgrade kernel-rtUpgrade kernel-sourceUpgrade dtb-broadcomUpgrade dtb-amlogicUpgrade kernel-debug-livepatch-develUpgrade kernel-kvmsmallUpgrade kernel-64kb-livepatch-develUpgrade dtb-apmUpgrade kernel-rt-livepatch-develUpgrade kernel-default-vdsoUpgrade kernel-default-manUpgrade kernel-default-extraUpgrade gfs2-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade dtb-qcomUpgrade kernel-rt-vdsoUpgrade kernel-obs-qaUpgrade gfs2-kmp-rtUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade dlm-kmp-64kbUpgrade kernel-macrosUpgrade dtb-rockchipUpgrade dlm-kmp-azureUpgrade dtb-freescaleUpgrade dtb-marvellUpgrade kernel-syms-rtUpgrade kernel-azure-develUpgrade reiserfs-kmp-azureUpgrade kernel-syms-azureUpgrade dtb-exynosUpgrade cluster-md-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-source-azureUpgrade kernel-kvmsmall-develUpgrade kernel-default-develUpgrade dtb-armUpgrade ocfs2-kmp-rtUpgrade kernel-default-base-rebuildUpgrade kernel-symsUpgrade kselftests-kmp-defaultUpgrade kernel-devel-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-docs-html | Mar 13, 2024 | Feb 22, 2024 |
| Ubuntu | — | Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1048-nvidia-lowlatencyUpgrade linux-image-5.4.0-1133-azureUpgrade linux-image-oemUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.5.0-1022-gcpUpgrade linux-image-5.15.0-1060-azureUpgrade linux-image-6.5.0-41-lowlatencyUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-oem-22.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-6.5.0-1024-oracle-64kUpgrade linux-image-5.15.0-1057-awsUpgrade linux-image-nvidiaUpgrade linux-image-aws-lts-20.04Upgrade linux-image-kvmUpgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-generic-64kUpgrade linux-image-azureUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-6.5.0-41-genericUpgrade linux-image-5.15.0-102-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-azure-lts-22.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-6.5.0-1021-awsUpgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.5.0-1021-nvidia-64kUpgrade linux-image-raspi-nolpaeUpgrade linux-image-6.5.0-1024-oemUpgrade linux-image-gke-5.15Upgrade linux-image-oem-22.04aUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.5.0-1018-raspiUpgrade linux-image-6.5.0-1017-laptopUpgrade linux-image-generic-lpaeUpgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-1040-gkeopUpgrade linux-image-5.4.0-1040-iotUpgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-5.15.0-102-generic-lpaeUpgrade linux-image-5.4.0-189-genericUpgrade linux-image-6.5.0-1022-azure-fdeUpgrade linux-image-oem-22.04bUpgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.15.0-1048-nvidiaUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-gkeop-5.4Upgrade linux-image-raspiUpgrade linux-image-oem-20.04cUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.5.0-1015-starfiveUpgrade linux-image-starfiveUpgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-6.5.0-1024-oracleUpgrade linux-image-nvidia-6.5Upgrade linux-image-azure-fdeUpgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-oracleUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-virtualUpgrade linux-image-5.15.0-1055-gcpUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-5.15.0-102-generic-64kUpgrade linux-image-azure-lts-20.04Upgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-genericUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-laptop-23.10Upgrade linux-image-gcpUpgrade linux-image-5.15.0-102-lowlatency-64kUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-6.5.0-41-lowlatency-64kUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-nvidia-64k-6.5Upgrade linux-image-6.5.0-1022-azureUpgrade linux-image-5.4.0-1128-awsUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-gkeUpgrade linux-image-bluefieldUpgrade linux-image-5.15.0-1054-kvmUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-oem-22.04dUpgrade linux-image-6.5.0-41-generic-64kUpgrade linux-image-5.15.0-1050-ibmUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-20.04dUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1055-oracleUpgrade linux-image-oem-20.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-intel-iotgUpgrade linux-image-6.5.0-1021-nvidiaUpgrade linux-image-azure-cvmUpgrade linux-image-raspi2Upgrade linux-image-awsUpgrade linux-image-oem-osp1Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-intelUpgrade linux-image-gkeopUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.15.0-1050-raspiUpgrade linux-image-5.15.0-1054-gkeUpgrade linux-image-5.15.0-1052-intel-iotgUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-5.15.0-102-genericUpgrade linux-image-5.15.0-1060-azure-fdeUpgrade linux-image-oracle-64k | Apr 10, 2024 | Feb 22, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub