In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
The rehash delayed work migrates filters from one region to another according to the number of available credits.
The migrated from region is destroyed at the end of the work if the number of credits is non-negative as the assumption is that this is indicative of migration being complete. This assumption is incorrect as a non-negative number of credits can also be the result of a failed migration.
The destruction of a region that still has filters referencing it can result in a use-after-free [1].
Fix by not destroying the region if migration failed.
[1] BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 Read of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858
CPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G W 6.9.0-rc2-custom-00782-gf2275c2157d8 #5 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70 mlxsw_sp_acl_atcam_entry_del+0x81/0x210 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK>
Allocated by task 174: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
Freed by task 7: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_region_destroy+0x272/0x310 mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-tools-libs-develUpgrade kernel-rtUpgrade kernel-rt-debug-coreUpgrade kernel-abi-stablelistsUpgrade kernel-docUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-rt-modulesUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-modules-extraUpgrade perfUpgrade kernel-rt-debugUpgrade kernel-headersUpgrade kernel-debugUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-develUpgrade kernel-rt-develUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-coreUpgrade kernel-cross-headersUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdumpUpgrade kernel-modulesUpgrade kernel-develUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-coreUpgrade kernel-rt-debug-modules-extraUpgrade python3-perfUpgrade kernel-rt-debug-develUpgrade kernel | Jul 3, 2024 | May 17, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernelUpgrade python-perf-debuginfoUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-develUpgrade kernel-livepatch-5.10.216-204.855Upgrade kernel-develUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perf | Apr 10, 2025 | May 17, 2024 |
| Debian | — | Upgrade linux | Jun 27, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libsUpgrade bpftool | Oct 8, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade bpftoolUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libs | Oct 9, 2024 | May 17, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | May 17, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 3, 2024 | May 17, 2024 |
| Rocky_linux | — | Upgrade kernel-rtUpgrade kernel-rt-debug-kvmUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-libs-develUpgrade kernel-headersUpgrade perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade python3-perfUpgrade kernel-rt-modulesUpgrade kernel-rt-coreUpgrade kernel-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-cross-headersUpgrade kernel-rt-debug-coreUpgrade kernel-debugUpgrade kernel-tools-libsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-debuginfoUpgrade bpftool-debuginfoUpgrade kernelUpgrade bpftoolUpgrade kernel-rt-kvmUpgrade kernel-rt-develUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debug-modulesUpgrade kernel-debug-develUpgrade kernel-rt-debugUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-debug-modules-extraUpgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-debug-coreUpgrade kernel-core | Jul 16, 2024 | May 17, 2024 |
| Suse | — | Upgrade reiserfs-kmp-rtUpgrade kernel-default-baseUpgrade dlm-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade dtb-mediatekUpgrade kernel-defaultUpgrade kernel-default-extraUpgrade dtb-alteraUpgrade ocfs2-kmp-azureUpgrade kernel-default-develUpgrade kernel-kvmsmall-develUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kernel-kvmsmallUpgrade kernel-source-azureUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-64kbUpgrade dtb-caviumUpgrade gfs2-kmp-rtUpgrade dtb-appleUpgrade kernel-azure-extraUpgrade kernel-rtUpgrade dtb-freescaleUpgrade kernel-devel-azureUpgrade kernel-default-livepatchUpgrade kernel-azure-develUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-develUpgrade kernel-rt-optionalUpgrade kernel-docs-htmlUpgrade kernel-sourceUpgrade kernel-rt-extraUpgrade kernel-obs-buildUpgrade kernel-debug-develUpgrade gfs2-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade kernel-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-default-optionalUpgrade kernel-source-rtUpgrade kernel-azure-optionalUpgrade kernel-kvmsmall-livepatch-develUpgrade cluster-md-kmp-azureUpgrade kernel-zfcpdumpUpgrade dtb-hisiliconUpgrade kernel-debug-vdsoUpgrade dtb-qcomUpgrade kernel-rt_debug-develUpgrade dtb-exynosUpgrade kernel-syms-azureUpgrade kernel-64kb-optionalUpgrade dtb-broadcomUpgrade kernel-rt-vdsoUpgrade dtb-lgUpgrade kernel-source-vanillaUpgrade kernel-rt-livepatchUpgrade dtb-allwinnerUpgrade kernel-kvmsmall-vdsoUpgrade dtb-amazonUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-defaultUpgrade kernel-debugUpgrade dlm-kmp-64kbUpgrade dtb-marvellUpgrade gfs2-kmp-azureUpgrade kernel-azureUpgrade kernel-symsUpgrade kernel-macrosUpgrade dtb-armUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-docsUpgrade dlm-kmp-azureUpgrade kselftests-kmp-defaultUpgrade dtb-renesasUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-default-livepatch-develUpgrade dtb-amdUpgrade kernel-syms-rtUpgrade kernel-default-base-rebuildUpgrade kernel-azure-vdsoUpgrade kernel-64kb-develUpgrade reiserfs-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-develUpgrade kernel-devel-rtUpgrade kernel-64kb-extraUpgrade dtb-rockchipUpgrade dtb-apmUpgrade kernel-rt_debugUpgrade dtb-sprdUpgrade kernel-rt_debug-vdsoUpgrade kernel-debug-livepatch-develUpgrade dtb-xilinxUpgrade reiserfs-kmp-azureUpgrade dtb-socionextUpgrade dtb-nvidiaUpgrade kernel-obs-qaUpgrade dtb-amlogic | Jun 13, 2024 | May 17, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-6.8.0-1010-oemUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-azure-cvmUpgrade linux-image-5.4.0-1040-iotUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-bluefieldUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.4.0-189-genericUpgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-aws-lts-22.04Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-raspi2Upgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1012-azureUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-awsUpgrade linux-image-virtualUpgrade linux-image-5.4.0-1128-awsUpgrade linux-image-kvmUpgrade linux-image-azure-fdeUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oem-20.04dUpgrade linux-image-oracleUpgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-5.4.0-1133-azureUpgrade linux-image-aws-lts-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-116-genericUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-generic-lpaeUpgrade linux-image-oem-20.04bUpgrade linux-image-oem-24.04Upgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-gke-5.15Upgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-gcpUpgrade linux-image-gkeUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-azureUpgrade linux-image-gkeop-5.4Upgrade linux-image-oem-20.04Upgrade linux-image-gkeopUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-oem-24.04aUpgrade linux-image-oem-osp1Upgrade linux-image-generic-64kUpgrade linux-image-azure-lts-20.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-nvidiaUpgrade linux-image-intelUpgrade linux-image-5.15.0-1068-azureUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-1013-awsUpgrade linux-image-oracle-64kUpgrade linux-image-ibmUpgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-oem-20.04cUpgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-nvidia-6.8Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-genericUpgrade linux-image-oemUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-5.15.0-116-generic-lpaeUpgrade linux-image-5.15.0-1065-awsUpgrade linux-image-oracle-lts-20.04 | Jul 15, 2024 | May 17, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub