In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_acl_tcam: Fix stack corruption
When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a list of ACLs. In turn, each ACL points to a different TCAM region where the filters are stored. During forwarding, the ACLs are sequentially evaluated until a match is found.
One reason to place filters in different regions is when they are added with decreasing priorities and in an alternating order so that two consecutive filters can never fit in the same region because of their key usage.
In Spectrum-2 and newer ASICs the firmware started to report that the maximum number of ACLs in a group is more than 16, but the layout of the register that configures ACL groups (PAGT) was not updated to account for that. It is therefore possible to hit stack corruption [1] in the rare case where more than 16 ACLs in a group are required.
Fix by limiting the maximum ACL group size to the minimum between what the firmware reports and the maximum ACLs that fit in the PAGT register.
Add a test case to make sure the machine does not crash when this condition is hit.
[1] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: mlxsw_sp_acl_tcam_group_update+0x116/0x120 [...] dump_stack_lvl+0x36/0x50 panic+0x305/0x330 __stack_chk_fail+0x15/0x20 mlxsw_sp_acl_tcam_group_update+0x116/0x120 mlxsw_sp_acl_tcam_group_region_attach+0x69/0x110 mlxsw_sp_acl_tcam_vchunk_get+0x492/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-coreUpgrade kernel-uki-virtUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-debug-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-modulesUpgrade kernel-tools-libsUpgrade kernel-64k-debug-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade rvUpgrade kernel-64k-debugUpgrade kernel-toolsUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-docUpgrade kernel-rtUpgrade kernel-tools-libs-develUpgrade kernel-rt-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-abi-stablelistsUpgrade kernel-debug-devel-matchedUpgrade kernel-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-develUpgrade kernel-headersUpgrade kernel-devel-matchedUpgrade kernel-debug-develUpgrade kernel-modules-coreUpgrade libperfUpgrade kernel-develUpgrade kernel-rt-debug-kvmUpgrade perfUpgrade kernel-debug-coreUpgrade kernelUpgrade kernel-64k-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-64kUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-debug-coreUpgrade kernel-rt-debugUpgrade kernel-64k-modulesUpgrade python3-perfUpgrade bpftoolUpgrade rtlaUpgrade kernel-cross-headersUpgrade kernel-64k-develUpgrade kernel-debugUpgrade kernel-rt-coreUpgrade kernel-rt-debug-develUpgrade kernel-64k-debug-develUpgrade kernel-rt-modules-extra | Aug 12, 2024 | Feb 22, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.15.148-97.158Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernelUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-livepatch-5.10.209-198.812Upgrade python-perfUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-tools-debuginfo | May 13, 2024 | Feb 22, 2024 |
| Debian | — | Upgrade linux | Jun 27, 2024 | Feb 22, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade python3-perf | May 13, 2024 | Feb 22, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-tools-libs | Jun 3, 2024 | Feb 22, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade python3-perf | Jul 1, 2024 | Feb 22, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-tools | Jul 17, 2024 | Feb 22, 2024 |
| Oracle_linux | — | Upgrade kernel | May 14, 2024 | Feb 22, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Apr 19, 2024 | Feb 22, 2024 |
| Rocky_linux | — | Upgrade kernel-cross-headersUpgrade kernel-rt-debug-modulesUpgrade python3-perf-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-tools-libsUpgrade kernel-debug-modulesUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rtUpgrade kernel-rt-debug-kvmUpgrade kernel-coreUpgrade kernel-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernelUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-kvmUpgrade kernel-rt-modulesUpgrade kernel-debug-coreUpgrade kernel-rt-coreUpgrade kernel-rt-develUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modulesUpgrade kernel-debug-develUpgrade bpftoolUpgrade python3-perfUpgrade kernel-rt-debugUpgrade kernel-debugUpgrade kernel-develUpgrade kernel-debuginfoUpgrade perfUpgrade kernel-tools-debuginfo | Aug 22, 2024 | Feb 22, 2024 |
| Suse | — | Upgrade kernel-rt-livepatch-develUpgrade dtb-freescaleUpgrade kernel-syms-rtUpgrade ocfs2-kmp-rtUpgrade dtb-exynosUpgrade gfs2-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-livepatch-develUpgrade dtb-lgUpgrade kernel-64kbUpgrade dtb-amazonUpgrade kernel-preemptUpgrade kernel-rt_debugUpgrade kernel-default-manUpgrade kernel-default-vdsoUpgrade kernel-macrosUpgrade dlm-kmp-azureUpgrade kernel-kvmsmall-vdsoUpgrade dtb-rockchipUpgrade gfs2-kmp-rtUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-azure-develUpgrade kernel-sourceUpgrade reiserfs-kmp-azureUpgrade kernel-syms-azureUpgrade dtb-armUpgrade cluster-md-kmp-azureUpgrade kernel-kvmsmall-develUpgrade dtb-qcomUpgrade dtb-marvellUpgrade kernel-64kb-livepatch-develUpgrade kselftests-kmp-64kbUpgrade dtb-broadcomUpgrade kernel-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-symsUpgrade dtb-amlogicUpgrade kernel-default-extraUpgrade kernel-obs-qaUpgrade dlm-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-zfcpdumpUpgrade dtb-apmUpgrade kernel-docs-htmlUpgrade kernel-debug-livepatch-develUpgrade kernel-default-develUpgrade kernel-devel-azureUpgrade kernel-source-azureUpgrade kernel-kvmsmallUpgrade gfs2-kmp-defaultUpgrade gfs2-kmp-azureUpgrade kernel-rt-livepatchUpgrade kernel-rt-extraUpgrade kernel-obs-buildUpgrade kernel-default-optionalUpgrade dtb-renesasUpgrade kernel-source-rtUpgrade kernel-debugUpgrade dlm-kmp-rtUpgrade kernel-docsUpgrade kernel-debug-vdsoUpgrade kernel-preempt-develUpgrade dtb-appleUpgrade kernel-64kb-optionalUpgrade kernel-defaultUpgrade kselftests-kmp-rtUpgrade dtb-sprdUpgrade kernel-rt_debug-develUpgrade dtb-alteraUpgrade kernel-default-livepatch-develUpgrade dtb-xilinxUpgrade dtb-nvidiaUpgrade dtb-allwinnerUpgrade kernel-develUpgrade dtb-mediatekUpgrade dlm-kmp-defaultUpgrade dtb-hisiliconUpgrade kernel-rt-develUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-64kb-extraUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-azure-optionalUpgrade kernel-64kb-develUpgrade dtb-caviumUpgrade reiserfs-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-default-livepatchUpgrade kernel-debug-develUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-default-baseUpgrade kselftests-kmp-azureUpgrade kernel-rt-optionalUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-azureUpgrade kernel-azure-extraUpgrade dtb-socionextUpgrade reiserfs-kmp-rtUpgrade dtb-amdUpgrade kernel-devel-rt | Mar 13, 2024 | Feb 22, 2024 |
| Ubuntu | — | Upgrade linux-image-bluefieldUpgrade linux-image-5.15.0-1060-azureUpgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.5.0-41-lowlatencyUpgrade linux-image-6.5.0-1022-azureUpgrade linux-image-6.5.0-41-lowlatency-64kUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1054-gkeUpgrade linux-image-oem-20.04dUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-laptop-23.10Upgrade linux-image-gcpUpgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-102-lowlatency-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-oem-osp1Upgrade linux-image-nvidia-64k-6.5Upgrade linux-image-5.15.0-102-genericUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-raspi2Upgrade linux-image-awsUpgrade linux-image-5.15.0-1048-nvidia-lowlatencyUpgrade linux-image-azure-lts-20.04Upgrade linux-image-oracle-64kUpgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-5.15.0-1050-raspiUpgrade linux-image-5.15.0-1050-ibmUpgrade linux-image-gkeopUpgrade linux-image-6.5.0-1022-gcpUpgrade linux-image-5.15.0-1055-gcpUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oracleUpgrade linux-image-intelUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1054-kvmUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-azure-cvmUpgrade linux-image-oem-20.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-5.15.0-1055-oracleUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.4.0-1128-awsUpgrade linux-image-gkeUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.15.0-102-generic-64kUpgrade linux-image-6.5.0-1021-nvidiaUpgrade linux-image-5.15.0-1060-azure-fdeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oemUpgrade linux-image-genericUpgrade linux-image-6.5.0-41-generic-64kUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.15.0-1052-intel-iotgUpgrade linux-image-5.4.0-1133-azureUpgrade linux-image-virtualUpgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-generic-lpaeUpgrade linux-image-azure-fdeUpgrade linux-image-kvmUpgrade linux-image-gkeop-5.4Upgrade linux-image-5.4.0-189-genericUpgrade linux-image-5.4.0-1040-iotUpgrade linux-image-oem-22.04Upgrade linux-image-generic-64kUpgrade linux-image-6.5.0-1021-awsUpgrade linux-image-azureUpgrade linux-image-oem-22.04bUpgrade linux-image-6.5.0-1024-oemUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-oem-20.04cUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-6.5.0-1022-azure-fdeUpgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-nvidiaUpgrade linux-image-raspi-nolpaeUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-gke-5.15Upgrade linux-image-oem-22.04cUpgrade linux-image-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-6.5.0-1021-nvidia-64kUpgrade linux-image-6.5.0-41-genericUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-5.15.0-1040-gkeopUpgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-5.15.0-102-generic-lpaeUpgrade linux-image-5.15.0-102-lowlatencyUpgrade linux-image-oem-20.04bUpgrade linux-image-aws-lts-20.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-starfiveUpgrade linux-image-6.5.0-1024-oracleUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-5.15.0-1048-nvidiaUpgrade linux-image-6.5.0-1017-laptopUpgrade linux-image-nvidia-6.5Upgrade linux-image-6.5.0-1024-oracle-64kUpgrade linux-image-6.5.0-1018-raspiUpgrade linux-image-6.5.0-1015-starfiveUpgrade linux-image-aws-lts-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-ibmUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-5.15.0-1057-aws | Apr 10, 2024 | Feb 22, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub