In the Linux kernel, the following vulnerability has been resolved:
net: marvell: prestera: fix incorrect structure access
In line: upper = info->upper_dev; We access upper_dev field, which is related only for particular events (e.g. event == NETDEV_CHANGEUPPER). So, this line cause invalid memory access for another events, when ptr is not netdev_notifier_changeupper_info.
The KASAN logs are as follows:
[ 30.123165] BUG: KASAN: stack-out-of-bounds in prestera_netdev_port_event.constprop.0+0x68/0x538 [prestera] [ 30.133336] Read of size 8 at addr ffff80000cf772b0 by task udevd/778 [ 30.139866] [ 30.141398] CPU: 0 PID: 778 Comm: udevd Not tainted 5.16.0-rc3 #6 [ 30.147588] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 30.153056] Call trace: [ 30.155547] dump_backtrace+0x0/0x2c0 [ 30.159320] show_stack+0x18/0x30 [ 30.162729] dump_stack_lvl+0x68/0x84 [ 30.166491] print_address_description.constprop.0+0x74/0x2b8 [ 30.172346] kasan_report+0x1e8/0x250 [ 30.176102] __asan_load8+0x98/0xe0 [ 30.179682] prestera_netdev_port_event.constprop.0+0x68/0x538 [prestera] [ 30.186847] prestera_netdev_event_handler+0x1b4/0x1c0 [prestera] [ 30.193313] raw_notifier_call_chain+0x74/0xa0 [ 30.197860] call_netdevice_notifiers_info+0x68/0xc0 [ 30.202924] register_netdevice+0x3cc/0x760 [ 30.207190] register_netdev+0x24/0x50 [ 30.211015] prestera_device_register+0x8a0/0xba0 [prestera]
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 4, 2024 |
| Suse | — | Upgrade dtb-hisiliconUpgrade dtb-xilinxUpgrade kernel-kvmsmallUpgrade kernel-rtUpgrade kernel-azure-livepatch-develUpgrade kernel-zfcpdumpUpgrade kernel-default-base-rebuildUpgrade dtb-exynosUpgrade dtb-amazonUpgrade kernel-kvmsmall-develUpgrade kernel-azure-extraUpgrade kernel-default-extraUpgrade kernel-default-livepatchUpgrade kernel-kvmsmall-vdsoUpgrade cluster-md-kmp-defaultUpgrade dtb-broadcomUpgrade cluster-md-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-docs-htmlUpgrade dtb-caviumUpgrade gfs2-kmp-rtUpgrade ocfs2-kmp-rtUpgrade kernel-devel-azureUpgrade gfs2-kmp-azureUpgrade kernel-azure-develUpgrade kernel-64kbUpgrade kernel-source-azureUpgrade kernel-64kb-livepatch-develUpgrade cluster-md-kmp-azureUpgrade kernel-rt-livepatchUpgrade kernel-azure-optionalUpgrade dtb-apmUpgrade kernel-sourceUpgrade kernel-kvmsmall-livepatch-develUpgrade dlm-kmp-64kbUpgrade kernel-default-vdsoUpgrade dtb-qcomUpgrade kernel-default-optionalUpgrade kernel-obs-qaUpgrade kernel-default-develUpgrade dtb-freescaleUpgrade kernel-source-rtUpgrade dtb-alteraUpgrade ocfs2-kmp-64kbUpgrade kernel-64kb-develUpgrade kernel-macrosUpgrade reiserfs-kmp-64kbUpgrade dtb-amlogicUpgrade kernel-syms-azureUpgrade kernel-symsUpgrade dtb-lgUpgrade gfs2-kmp-64kbUpgrade kernel-debug-livepatch-develUpgrade kselftests-kmp-64kbUpgrade kernel-64kb-optionalUpgrade dtb-mediatekUpgrade dtb-appleUpgrade dlm-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-devel-rtUpgrade dtb-nvidiaUpgrade kernel-source-vanillaUpgrade kernel-rt_debugUpgrade kernel-default-livepatch-develUpgrade dtb-armUpgrade dtb-socionextUpgrade dtb-allwinnerUpgrade kernel-rt-vdsoUpgrade kernel-develUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-syms-rtUpgrade kselftests-kmp-defaultUpgrade kernel-rt-extraUpgrade dtb-rockchipUpgrade cluster-md-kmp-64kbUpgrade dtb-amdUpgrade kernel-default-baseUpgrade kernel-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-docsUpgrade dtb-marvellUpgrade reiserfs-kmp-azureUpgrade dtb-renesasUpgrade kernel-debug-vdsoUpgrade dtb-sprdUpgrade kernel-rt-livepatch-develUpgrade kernel-64kb-extraUpgrade kernel-obs-buildUpgrade kernel-azure-vdsoUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-debugUpgrade kernel-rt-develUpgrade kernel-defaultUpgrade kernel-debug-develUpgrade gfs2-kmp-defaultUpgrade kernel-rt_debug-vdsoUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-azure | Aug 9, 2024 | Mar 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub