In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
The rehash delayed work migrates filters from one region to another according to the number of available credits.
The migrated from region is destroyed at the end of the work if the number of credits is non-negative as the assumption is that this is indicative of migration being complete. This assumption is incorrect as a non-negative number of credits can also be the result of a failed migration.
The destruction of a region that still has filters referencing it can result in a use-after-free [1].
Fix by not destroying the region if migration failed.
[1] BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 Read of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858
CPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G W 6.9.0-rc2-custom-00782-gf2275c2157d8 #5 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70 mlxsw_sp_acl_atcam_entry_del+0x81/0x210 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK>
Allocated by task 174: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
Freed by task 7: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_region_destroy+0x272/0x310 mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdumpUpgrade kernel-rt-debugUpgrade kernel-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-develUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade kernel-debug-develUpgrade kernelUpgrade kernel-debug-coreUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-coreUpgrade kernel-cross-headersUpgrade python3-perfUpgrade kernel-headersUpgrade perfUpgrade kernel-rt-develUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade bpftoolUpgrade kernel-docUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modulesUpgrade kernel-toolsUpgrade kernel-tools-libs-develUpgrade kernel-rtUpgrade kernel-rt-kvm | Jul 3, 2024 | May 17, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.10.216-204.855Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-develUpgrade bpftoolUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernelUpgrade perf-debuginfoUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade python-perfUpgrade bpftool-debuginfo | Apr 10, 2025 | May 17, 2024 |
| Debian | — | Upgrade linux | Jun 27, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade python3-perf | Oct 8, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel | Oct 9, 2024 | May 17, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | May 17, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Jul 3, 2024 | May 17, 2024 |
| Rocky_linux | — | Upgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rtUpgrade kernel-tools-libs-develUpgrade perfUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-develUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debug-develUpgrade kernel-rt-debug-modulesUpgrade python3-perf-debuginfoUpgrade kernelUpgrade bpftoolUpgrade kernel-rt-kvmUpgrade kernel-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-tools-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-coreUpgrade kernel-rt-modules-extraUpgrade kernel-rt-coreUpgrade kernel-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-debug-debuginfoUpgrade kernel-tools-libsUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-cross-headersUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-rt-debugUpgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade kernel-debug | Jul 16, 2024 | May 17, 2024 |
| Suse | — | Upgrade cluster-md-kmp-rtUpgrade dtb-freescaleUpgrade kernel-docs-htmlUpgrade reiserfs-kmp-64kbUpgrade gfs2-kmp-rtUpgrade dtb-caviumUpgrade dtb-appleUpgrade kernel-source-azureUpgrade kernel-kvmsmallUpgrade kernel-default-develUpgrade kernel-azure-extraUpgrade kernel-default-vdsoUpgrade gfs2-kmp-64kbUpgrade gfs2-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-azure-develUpgrade kernel-rt-optionalUpgrade kernel-develUpgrade kernel-source-rtUpgrade kernel-rt-extraUpgrade kernel-64kbUpgrade kernel-rt_debug-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-debug-vdsoUpgrade kernel-azureUpgrade dtb-hisiliconUpgrade dtb-broadcomUpgrade kselftests-kmp-64kbUpgrade dtb-qcomUpgrade kernel-obs-buildUpgrade kernel-sourceUpgrade kernel-azure-optionalUpgrade kernel-64kb-livepatch-develUpgrade kernel-default-optionalUpgrade kernel-source-vanillaUpgrade dtb-allwinnerUpgrade dlm-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-livepatchUpgrade dtb-marvellUpgrade dtb-lgUpgrade kernel-debug-develUpgrade cluster-md-kmp-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-syms-azureUpgrade kernel-rt-livepatchUpgrade dtb-exynosUpgrade dtb-amazonUpgrade dtb-alteraUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade kernel-devel-azureUpgrade kernel-debugUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-rtUpgrade dtb-armUpgrade kernel-obs-qaUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-rtUpgrade dtb-amlogicUpgrade dtb-mediatekUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-debug-livepatch-develUpgrade dtb-xilinxUpgrade kernel-docsUpgrade dtb-renesasUpgrade dlm-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-default-extraUpgrade dtb-sprdUpgrade kernel-rt_debugUpgrade kernel-macrosUpgrade dtb-apmUpgrade kernel-default-baseUpgrade kernel-rt-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade dtb-rockchipUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-symsUpgrade dtb-amdUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-develUpgrade kernel-syms-rtUpgrade kernel-default-base-rebuildUpgrade kernel-devel-rtUpgrade kernel-64kb-extraUpgrade kernel-azure-vdsoUpgrade kernel-rt-devel | Jun 13, 2024 | May 17, 2024 |
| Ubuntu | — | Upgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-ibmUpgrade linux-image-azureUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.15.0-1068-azureUpgrade linux-image-intelUpgrade linux-image-oem-20.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-gcpUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-gkeUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-lowlatencyUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-nvidia-64kUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-nvidiaUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1013-awsUpgrade linux-image-gkeopUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-oem-20.04cUpgrade linux-image-oemUpgrade linux-image-nvidia-6.8Upgrade linux-image-gke-5.15Upgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-genericUpgrade linux-image-generic-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-oem-24.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-oem-osp1Upgrade linux-image-oem-24.04aUpgrade linux-image-raspiUpgrade linux-image-5.15.0-116-generic-lpaeUpgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-intel-iotgUpgrade linux-image-gkeop-5.4Upgrade linux-image-5.15.0-1065-awsUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-oem-20.04dUpgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-raspi-nolpaeUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.4.0-1128-awsUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.4.0-1133-azureUpgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-gkeop-5.15Upgrade linux-image-oracleUpgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-5.4.0-1040-iotUpgrade linux-image-raspi2Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-aws-lts-20.04Upgrade linux-image-kvmUpgrade linux-image-ibm-classicUpgrade linux-image-azure-fdeUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-5.15.0-116-genericUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-40-genericUpgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-5.4.0-189-genericUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-bluefieldUpgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-azure-cvmUpgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-awsUpgrade linux-image-6.8.0-1010-oem | Jul 15, 2024 | May 17, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub