In the Linux kernel, the following vulnerability has been resolved:
nexthop: Fix division by zero while replacing a resilient group
The resilient nexthop group torture tests in fib_nexthop.sh exposed a possible division by zero while replacing a resilient group [1]. The division by zero occurs when the data path sees a resilient nexthop group with zero buckets.
The tests replace a resilient nexthop group in a loop while traffic is forwarded through it. The tests do not specify the number of buckets while performing the replacement, resulting in the kernel allocating a stub resilient table (i.e, 'struct nh_res_table') with zero buckets.
This table should never be visible to the data path, but the old nexthop group (i.e., 'oldg') might still be used by the data path when the stub table is assigned to it.
Fix this by only assigning the stub table to the old nexthop group after making sure the group is no longer used by the data path.
Tested with fib_nexthops.sh:
Tests passed: 222 Tests failed: 0
[1] divide error: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 1850 Comm: ping Not tainted 5.14.0-custom-10271-ga86eb53057fe #1107 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014 RIP: 0010:nexthop_select_path+0x2d2/0x1a80 [...] Call Trace: fib_select_multipath+0x79b/0x1530 fib_select_path+0x8fb/0x1c10 ip_route_output_key_hash_rcu+0x1198/0x2da0 ip_route_output_key_hash+0x190/0x340 ip_route_output_flow+0x21/0x120 raw_sendmsg+0x91d/0x2e10 inet_sendmsg+0x9e/0xe0 __sys_sendto+0x23d/0x360 __x64_sys_sendto+0xe1/0x1b0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-develUpgrade kernel-docsUpgrade dtb-caviumUpgrade kernel-devel-rtUpgrade kernel-default-baseUpgrade dtb-armUpgrade kernel-defaultUpgrade kselftests-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-64kb-optionalUpgrade dtb-nvidiaUpgrade kernel-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-64kb-develUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade kernel-debugUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-optionalUpgrade dtb-hisiliconUpgrade dtb-sprdUpgrade kernel-64kb-extraUpgrade kernel-source-rtUpgrade ocfs2-kmp-azureUpgrade dtb-amdUpgrade dtb-xilinxUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-rtUpgrade dtb-renesasUpgrade dtb-allwinnerUpgrade gfs2-kmp-defaultUpgrade kselftests-kmp-rtUpgrade dtb-marvellUpgrade kselftests-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade dlm-kmp-rtUpgrade kernel-debug-vdsoUpgrade kernel-azure-extraUpgrade kernel-debug-develUpgrade dtb-rockchipUpgrade cluster-md-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-rt_debugUpgrade kernel-rt-extraUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-socionextUpgrade kernel-default-optionalUpgrade kernel-obs-buildUpgrade kernel-source-vanillaUpgrade dtb-appleUpgrade kernel-obs-qaUpgrade kernel-rtUpgrade kernel-azure-vdsoUpgrade kernel-symsUpgrade kernel-zfcpdumpUpgrade kernel-rt-livepatchUpgrade dtb-amazonUpgrade kernel-syms-rtUpgrade dtb-lgUpgrade kernel-debug-livepatch-develUpgrade kernel-64kbUpgrade kernel-sourceUpgrade ocfs2-kmp-64kbUpgrade kernel-default-develUpgrade kernel-rt-develUpgrade kernel-azure-livepatch-develUpgrade reiserfs-kmp-azureUpgrade kernel-default-base-rebuildUpgrade dtb-qcomUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade dlm-kmp-64kbUpgrade kernel-devel-azureUpgrade kernel-64kb-livepatch-develUpgrade dtb-apmUpgrade dtb-exynosUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-vdsoUpgrade kernel-macrosUpgrade dtb-alteraUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-64kbUpgrade dtb-amlogicUpgrade cluster-md-kmp-azureUpgrade kernel-default-livepatchUpgrade kernel-kvmsmall-develUpgrade dtb-broadcomUpgrade gfs2-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-azure-optionalUpgrade kernel-kvmsmallUpgrade kernel-default-extraUpgrade ocfs2-kmp-rtUpgrade dtb-mediatekUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-freescaleUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-develUpgrade kernel-syms-azure | Aug 9, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub