In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
The rehash delayed work migrates filters from one region to another according to the number of available credits.
The migrated from region is destroyed at the end of the work if the number of credits is non-negative as the assumption is that this is indicative of migration being complete. This assumption is incorrect as a non-negative number of credits can also be the result of a failed migration.
The destruction of a region that still has filters referencing it can result in a use-after-free [1].
Fix by not destroying the region if migration failed.
[1] BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 Read of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858
CPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G W 6.9.0-rc2-custom-00782-gf2275c2157d8 #5 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70 mlxsw_sp_acl_atcam_entry_del+0x81/0x210 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK>
Allocated by task 174: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
Freed by task 7: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_region_destroy+0x272/0x310 mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-rt-kvmUpgrade kernel-rt-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-toolsUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-rtUpgrade kernel-docUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-develUpgrade kernel-zfcpdump-develUpgrade kernel-debugUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-develUpgrade kernel-rt-develUpgrade kernel-coreUpgrade kernel-tools-libsUpgrade kernel-cross-headersUpgrade kernel-rt-debugUpgrade kernel-zfcpdump-modules-extraUpgrade perfUpgrade kernelUpgrade kernel-debug-modulesUpgrade kernel-rt-coreUpgrade kernel-modulesUpgrade kernel-debug-coreUpgrade python3-perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-develUpgrade kernel-modules-extraUpgrade kernel-headersUpgrade kernel-rt-debug-kvm | Jul 3, 2024 | May 17, 2024 |
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade kernel-livepatch-5.10.216-204.855Upgrade kernel-headersUpgrade kernel-develUpgrade python-perf-debuginfoUpgrade perfUpgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade python-perfUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfo | Apr 10, 2025 | May 17, 2024 |
| Debian | — | Upgrade linux | Jun 27, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade bpftoolUpgrade kernel-tools-libs | Oct 8, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade kernelUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libs | Oct 9, 2024 | May 17, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | May 17, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 3, 2024 | May 17, 2024 |
| Rocky_linux | — | Upgrade perfUpgrade kernel-rtUpgrade kernel-rt-debug-develUpgrade kernel-tools-libs-develUpgrade python3-perfUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-rt-debug-kvmUpgrade kernel-headersUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debugUpgrade kernel-modulesUpgrade kernel-rt-debugUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-modules-extraUpgrade kernel-rt-debuginfoUpgrade kernel-rt-coreUpgrade kernel-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-coreUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-cross-headersUpgrade kernel-rt-debug-coreUpgrade kernelUpgrade bpftoolUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-develUpgrade kernel-rt-kvmUpgrade kernel-rt-develUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-modulesUpgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debug-modules-extraUpgrade bpftool-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-tools-libs | Jul 16, 2024 | May 17, 2024 |
| Suse | — | Upgrade dtb-socionextUpgrade kernel-macrosUpgrade reiserfs-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade dtb-nvidiaUpgrade dtb-mediatekUpgrade kernel-64kb-develUpgrade kernel-rt_debugUpgrade kernel-rt-develUpgrade dtb-apmUpgrade dtb-rockchipUpgrade kernel-64kb-extraUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-livepatch-develUpgrade kernel-devel-rtUpgrade dtb-renesasUpgrade kselftests-kmp-defaultUpgrade kernel-docsUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-rtUpgrade dtb-armUpgrade cluster-md-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade kernel-default-livepatch-develUpgrade kernel-default-baseUpgrade kernel-symsUpgrade dtb-amlogicUpgrade kernel-default-extraUpgrade kernel-obs-qaUpgrade kselftests-kmp-rtUpgrade dlm-kmp-defaultUpgrade dtb-amdUpgrade kernel-defaultUpgrade dtb-sprdUpgrade kernel-azure-vdsoUpgrade kernel-debug-livepatch-develUpgrade dtb-xilinxUpgrade kernel-syms-rtUpgrade kernel-rt_debug-vdsoUpgrade reiserfs-kmp-azureUpgrade kernel-default-base-rebuildUpgrade kernel-kvmsmall-livepatch-develUpgrade kselftests-kmp-64kbUpgrade dtb-hisiliconUpgrade dtb-allwinnerUpgrade kernel-rt_debug-develUpgrade kernel-default-optionalUpgrade kernel-azureUpgrade kernel-azure-optionalUpgrade kernel-debug-vdsoUpgrade kernel-64kb-livepatch-develUpgrade dtb-broadcomUpgrade kernel-source-rtUpgrade kernel-develUpgrade kernel-azure-develUpgrade dtb-lgUpgrade kernel-default-livepatchUpgrade gfs2-kmp-azureUpgrade kernel-debug-develUpgrade kernel-devel-azureUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-rtUpgrade kernel-kvmsmall-develUpgrade kernel-debugUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-defaultUpgrade dtb-freescaleUpgrade dtb-alteraUpgrade kernel-azure-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade gfs2-kmp-rtUpgrade kernel-default-develUpgrade dtb-appleUpgrade kernel-source-azureUpgrade kernel-default-vdsoUpgrade kernel-azure-extraUpgrade reiserfs-kmp-64kbUpgrade kernel-kvmsmallUpgrade dtb-caviumUpgrade kernel-rt-livepatchUpgrade dtb-exynosUpgrade dtb-amazonUpgrade kernel-syms-azureUpgrade kernel-64kbUpgrade dtb-qcomUpgrade kernel-sourceUpgrade kernel-rt-extraUpgrade kernel-obs-buildUpgrade ocfs2-kmp-defaultUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-64kbUpgrade kernel-rt-optionalUpgrade cluster-md-kmp-rtUpgrade kernel-rt-vdsoUpgrade kernel-source-vanillaUpgrade kernel-docs-htmlUpgrade cluster-md-kmp-azureUpgrade dtb-marvell | Jun 13, 2024 | May 17, 2024 |
| Ubuntu | — | Upgrade linux-image-azure-lts-22.04Upgrade linux-image-lowlatencyUpgrade linux-image-azureUpgrade linux-image-gcpUpgrade linux-image-intelUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-intel-iotgUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.8.0-1013-awsUpgrade linux-image-oracle-64kUpgrade linux-image-5.15.0-1068-azureUpgrade linux-image-gkeUpgrade linux-image-oem-osp1Upgrade linux-image-nvidia-6.8Upgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-ibmUpgrade linux-image-oem-24.04Upgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-oem-20.04cUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-raspiUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-116-generic-lpaeUpgrade linux-image-genericUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-oem-20.04bUpgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1065-awsUpgrade linux-image-gkeopUpgrade linux-image-azure-lts-20.04Upgrade linux-image-oem-20.04Upgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-oem-24.04aUpgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-gkeop-5.4Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-nvidiaUpgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-oemUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-virtualUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-raspi-nolpaeUpgrade linux-image-awsUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-bluefieldUpgrade linux-image-5.4.0-189-genericUpgrade linux-image-azure-cvmUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-oracleUpgrade linux-image-5.4.0-1133-azureUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-oem-20.04dUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-5.4.0-1040-iotUpgrade linux-image-5.4.0-1128-awsUpgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-5.15.0-116-genericUpgrade linux-image-raspi2Upgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-6.8.0-1012-azureUpgrade linux-image-6.8.0-1010-oemUpgrade linux-image-kvmUpgrade linux-image-aws-lts-20.04Upgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1011-nvidia-lowlatency | Jul 15, 2024 | May 17, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub