In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_acl_tcam: Fix stack corruption
When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a list of ACLs. In turn, each ACL points to a different TCAM region where the filters are stored. During forwarding, the ACLs are sequentially evaluated until a match is found.
One reason to place filters in different regions is when they are added with decreasing priorities and in an alternating order so that two consecutive filters can never fit in the same region because of their key usage.
In Spectrum-2 and newer ASICs the firmware started to report that the maximum number of ACLs in a group is more than 16, but the layout of the register that configures ACL groups (PAGT) was not updated to account for that. It is therefore possible to hit stack corruption [1] in the rare case where more than 16 ACLs in a group are required.
Fix by limiting the maximum ACL group size to the minimum between what the firmware reports and the maximum ACLs that fit in the PAGT register.
Add a test case to make sure the machine does not crash when this condition is hit.
[1] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: mlxsw_sp_acl_tcam_group_update+0x116/0x120 [...] dump_stack_lvl+0x36/0x50 panic+0x305/0x330 __stack_chk_fail+0x15/0x20 mlxsw_sp_acl_tcam_group_update+0x116/0x120 mlxsw_sp_acl_tcam_group_region_attach+0x69/0x110 mlxsw_sp_acl_tcam_vchunk_get+0x492/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-zfcpdump-modulesUpgrade kernel-tools-libsUpgrade kernel-64k-modules-extraUpgrade kernel-docUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade kernel-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-toolsUpgrade rvUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rtUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-modulesUpgrade kernel-tools-libs-develUpgrade kernel-debug-modulesUpgrade kernel-64k-debugUpgrade kernel-64k-coreUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-debug-devel-matchedUpgrade kernel-uki-virtUpgrade kernel-zfcpdumpUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-debug-modules-coreUpgrade kernel-64k-debug-coreUpgrade perfUpgrade kernel-64kUpgrade kernel-debug-uki-virtUpgrade kernelUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-64k-debug-develUpgrade kernel-rt-develUpgrade kernel-64k-develUpgrade kernel-debug-develUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modules-coreUpgrade kernel-rt-coreUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-64k-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-devel-matchedUpgrade bpftoolUpgrade kernel-debugUpgrade kernel-debug-coreUpgrade kernel-develUpgrade python3-perfUpgrade libperfUpgrade kernel-headersUpgrade kernel-rt-debugUpgrade rtla | Aug 12, 2024 | Feb 22, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade kernel-livepatch-5.10.209-198.812Upgrade bpftoolUpgrade kernelUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.15.148-97.158Upgrade kernel-tools-debuginfoUpgrade python-perf-debuginfoUpgrade bpftool-debuginfoUpgrade perfUpgrade kernel-tools-develUpgrade kernel-headersUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade python-perfUpgrade perf-debuginfo | May 13, 2024 | Feb 22, 2024 |
| Debian | — | Upgrade linux | Jun 27, 2024 | Feb 22, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-tools | May 13, 2024 | Feb 22, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftoolUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools | Jun 3, 2024 | Feb 22, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-perfUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools | Jul 1, 2024 | Feb 22, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade python3-perf | Jul 17, 2024 | Feb 22, 2024 |
| Oracle_linux | — | Upgrade kernel | May 14, 2024 | Feb 22, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Apr 19, 2024 | Feb 22, 2024 |
| Rocky_linux | — | Upgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-tools-libs-develUpgrade kernel-debugUpgrade python3-perfUpgrade kernel-tools-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-develUpgrade bpftoolUpgrade kernel-rt-debugUpgrade kernel-modulesUpgrade kernel-debug-coreUpgrade kernel-rt-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-coreUpgrade perfUpgrade kernel-debuginfoUpgrade kernel-debug-develUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debug-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-rtUpgrade kernel-modules-extraUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-headersUpgrade kernel-rt-debug-kvmUpgrade kernel-coreUpgrade kernel-rt-debug-develUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debuginfoUpgrade kernel-cross-headersUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64 | Aug 22, 2024 | Feb 22, 2024 |
| Suse | — | Upgrade kernel-kvmsmallUpgrade kernel-syms-rtUpgrade ocfs2-kmp-rtUpgrade kernel-default-vdsoUpgrade kernel-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-syms-azureUpgrade dtb-exynosUpgrade dtb-qcomUpgrade kernel-default-base-rebuildUpgrade kernel-rt-livepatch-develUpgrade gfs2-kmp-rtUpgrade kernel-azure-vdsoUpgrade dlm-kmp-azureUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-extraUpgrade kernel-obs-qaUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade kernel-macrosUpgrade dtb-apmUpgrade kernel-docs-htmlUpgrade cluster-md-kmp-azureUpgrade kernel-devel-azureUpgrade kernel-kvmsmall-develUpgrade kernel-zfcpdumpUpgrade kernel-debug-livepatch-develUpgrade kernel-preemptUpgrade kernel-source-azureUpgrade dtb-lgUpgrade kernel-sourceUpgrade kernel-rt_debugUpgrade kselftests-kmp-defaultUpgrade dtb-amlogicUpgrade dtb-armUpgrade kernel-default-develUpgrade dtb-broadcomUpgrade kernel-azure-develUpgrade reiserfs-kmp-azureUpgrade dtb-freescaleUpgrade kernel-rt_debug-vdsoUpgrade kernel-symsUpgrade dtb-amazonUpgrade kernel-rtUpgrade dtb-marvellUpgrade kernel-64kb-livepatch-develUpgrade kselftests-kmp-64kbUpgrade kernel-default-manUpgrade dtb-rockchipUpgrade kernel-rt-optionalUpgrade kernel-develUpgrade dtb-mediatekUpgrade kernel-source-rtUpgrade dtb-hisiliconUpgrade dlm-kmp-defaultUpgrade kernel-docsUpgrade kernel-debug-vdsoUpgrade kernel-debugUpgrade dtb-socionextUpgrade dtb-nvidiaUpgrade dtb-appleUpgrade dtb-allwinnerUpgrade dlm-kmp-rtUpgrade kernel-preempt-develUpgrade gfs2-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-rt-livepatchUpgrade kernel-64kb-optionalUpgrade dtb-xilinxUpgrade kselftests-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-rt-develUpgrade kernel-defaultUpgrade dtb-alteraUpgrade dtb-sprdUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-azure-optionalUpgrade kernel-64kb-extraUpgrade kernel-64kb-develUpgrade dtb-caviumUpgrade cluster-md-kmp-64kbUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-rtUpgrade kernel-default-livepatchUpgrade kernel-default-baseUpgrade kernel-debug-develUpgrade ocfs2-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kernel-obs-buildUpgrade kernel-default-optionalUpgrade kernel-azure-extraUpgrade kernel-azureUpgrade dtb-amdUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kernel-devel-rtUpgrade gfs2-kmp-defaultUpgrade dtb-renesas | Mar 13, 2024 | Feb 22, 2024 |
| Ubuntu | — | Upgrade linux-image-oem-22.04dUpgrade linux-image-gcpUpgrade linux-image-5.15.0-1050-ibmUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-bluefieldUpgrade linux-image-intel-iotgUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-awsUpgrade linux-image-5.15.0-102-generic-64kUpgrade linux-image-gkeop-5.15Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-5.15.0-1055-oracleUpgrade linux-image-5.15.0-102-genericUpgrade linux-image-6.5.0-1022-azureUpgrade linux-image-oracle-64kUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.15.0-1060-azure-fdeUpgrade linux-image-oem-20.04Upgrade linux-image-6.5.0-1021-nvidiaUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-azure-cvmUpgrade linux-image-oem-20.04dUpgrade linux-image-laptop-23.10Upgrade linux-image-5.15.0-102-lowlatency-64kUpgrade linux-image-5.15.0-1052-intel-iotgUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-genericUpgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-oem-osp1Upgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-6.5.0-1022-gcpUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-5.4.0-1128-awsUpgrade linux-image-5.4.0-1133-azureUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-1048-nvidia-lowlatencyUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-5.15.0-1055-gcpUpgrade linux-image-virtualUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-gkeopUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-6.5.0-41-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-oemUpgrade linux-image-5.15.0-1054-kvmUpgrade linux-image-5.15.0-1060-azureUpgrade linux-image-6.5.0-41-generic-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-1050-raspiUpgrade linux-image-oracleUpgrade linux-image-5.15.0-1054-gkeUpgrade linux-image-raspi2Upgrade linux-image-6.5.0-41-lowlatency-64kUpgrade linux-image-intelUpgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-102-lowlatencyUpgrade linux-image-5.15.0-1057-awsUpgrade linux-image-aws-lts-20.04Upgrade linux-image-6.5.0-41-genericUpgrade linux-image-azure-fdeUpgrade linux-image-6.5.0-1018-raspiUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1048-nvidiaUpgrade linux-image-5.4.0-189-genericUpgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-oem-20.04bUpgrade linux-image-lowlatency-64kUpgrade linux-image-azure-lts-22.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-oem-22.04bUpgrade linux-image-5.15.0-1040-gkeopUpgrade linux-image-5.15.0-102-generic-lpaeUpgrade linux-image-6.5.0-1021-awsUpgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-oem-20.04cUpgrade linux-image-ibmUpgrade linux-image-gkeop-5.4Upgrade linux-image-oem-22.04Upgrade linux-image-nvidiaUpgrade linux-image-aws-lts-22.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-raspiUpgrade linux-image-oem-22.04cUpgrade linux-image-lowlatencyUpgrade linux-image-6.5.0-1021-nvidia-64kUpgrade linux-image-5.4.0-1040-iotUpgrade linux-image-6.5.0-1022-azure-fdeUpgrade linux-image-kvmUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.5.0-1015-starfiveUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-6.5.0-1024-oracle-64kUpgrade linux-image-starfiveUpgrade linux-image-6.5.0-1017-laptopUpgrade linux-image-6.5.0-1024-oracleUpgrade linux-image-nvidia-6.5Upgrade linux-image-6.5.0-1024-oemUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-oem-22.04aUpgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-azureUpgrade linux-image-generic-64kUpgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-generic-64k-hwe-20.04 | Apr 10, 2024 | Feb 22, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub