In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
The rule activity update delayed work periodically traverses the list of configured rules and queries their activity from the device.
As part of this task it accesses the entry pointed by 'ventry->entry', but this entry can be changed concurrently by the rehash delayed work, leading to a use-after-free [1].
Fix by closing the race and perform the activity query under the 'vregion->lock' mutex.
[1] BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 Read of size 8 at addr ffff8881054ed808 by task kworker/0:18/181
CPU: 0 PID: 181 Comm: kworker/0:18 Not tainted 6.9.0-rc2-custom-00781-gd5ab772d32f7 #2 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 mlxsw_sp_acl_rule_activity_update_work+0x219/0x400 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK>
Allocated by task 1039: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_entry_create+0x7b/0x1f0 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x30d/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
Freed by task 1039: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modulesUpgrade perfUpgrade kernel-debugUpgrade kernel-modules-extraUpgrade kernel-coreUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-develUpgrade kernel-debug-modules-extraUpgrade kernel-headersUpgrade kernel-docUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-coreUpgrade kernel-rt-modulesUpgrade kernel-modulesUpgrade kernel-debug-develUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-modulesUpgrade kernel-rtUpgrade kernelUpgrade kernel-rt-debugUpgrade kernel-rt-kvmUpgrade kernel-develUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-coreUpgrade python3-perfUpgrade kernel-rt-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-tools-libs-develUpgrade kernel-cross-headersUpgrade kernel-tools-libs | Jul 3, 2024 | May 17, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade kernelUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade perfUpgrade kernel-toolsUpgrade python-perfUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-livepatch-5.10.216-204.855 | Apr 10, 2025 | May 17, 2024 |
| Debian | — | Upgrade linux | Jun 27, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-abi-stablelists | Oct 8, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade python3-perf | Oct 8, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel | Oct 9, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-tools | Oct 8, 2024 | May 17, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | May 17, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Jul 3, 2024 | May 17, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-modules-extraUpgrade python3-perfUpgrade kernel-headersUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade perfUpgrade kernel-cross-headersUpgrade kernelUpgrade kernel-tools-libs-develUpgrade kernel-rtUpgrade kernel-rt-modulesUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernel-debug-develUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debuginfoUpgrade kernel-tools-libsUpgrade kernel-rt-debugUpgrade kernel-debug-debuginfoUpgrade kernel-debuginfoUpgrade bpftoolUpgrade kernel-debug-modules-extraUpgrade bpftool-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-debugUpgrade kernel-rt-kvmUpgrade kernel-modulesUpgrade python3-perf-debuginfoUpgrade kernel-coreUpgrade kernel-rt-develUpgrade kernel-debug-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-debuginfo-common-x86_64 | Jul 16, 2024 | May 17, 2024 |
| Suse | — | Upgrade kernel-rtUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-debug-livepatch-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-docsUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade kernel-rt-livepatch-develUpgrade reiserfs-kmp-rtUpgrade dtb-broadcomUpgrade kernel-obs-buildUpgrade dtb-apmUpgrade kernel-rt_debugUpgrade dlm-kmp-azureUpgrade dtb-amlogicUpgrade kernel-syms-rtUpgrade kernel-azure-livepatch-develUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-macrosUpgrade kernel-zfcpdumpUpgrade ocfs2-kmp-rtUpgrade kernel-default-extraUpgrade kernel-rt_debug-vdsoUpgrade dtb-socionextUpgrade kernel-syms-azureUpgrade kernel-docs-htmlUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-vdsoUpgrade kernel-default-base-rebuildUpgrade kselftests-kmp-rtUpgrade cluster-md-kmp-azureUpgrade dtb-appleUpgrade reiserfs-kmp-64kbUpgrade kernel-azure-develUpgrade kernel-defaultUpgrade gfs2-kmp-64kbUpgrade kernel-obs-qaUpgrade dtb-armUpgrade kernel-rt-extraUpgrade kernel-rt-optionalUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-vdsoUpgrade kernel-source-rtUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-defaultUpgrade dtb-marvellUpgrade kernel-azure-extraUpgrade dtb-amazonUpgrade ocfs2-kmp-azureUpgrade kernel-azure-optionalUpgrade dtb-qcomUpgrade kernel-symsUpgrade dtb-allwinnerUpgrade cluster-md-kmp-64kbUpgrade gfs2-kmp-azureUpgrade kernel-default-livepatchUpgrade reiserfs-kmp-azureUpgrade dtb-alteraUpgrade kernel-rt-develUpgrade kernel-source-azureUpgrade kselftests-kmp-64kbUpgrade kernel-64kb-extraUpgrade kernel-64kbUpgrade dtb-lgUpgrade kernel-rt_debug-develUpgrade kernel-rt-livepatchUpgrade kernel-default-vdsoUpgrade dtb-mediatekUpgrade kernel-debug-develUpgrade dtb-caviumUpgrade kernel-devel-rtUpgrade kselftests-kmp-azureUpgrade kernel-sourceUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-rtUpgrade kernel-default-optionalUpgrade kernel-64kb-optionalUpgrade dlm-kmp-rtUpgrade dlm-kmp-64kbUpgrade dtb-nvidiaUpgrade kernel-default-develUpgrade dtb-freescaleUpgrade ocfs2-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-azureUpgrade dtb-xilinxUpgrade kernel-develUpgrade reiserfs-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-develUpgrade dtb-renesasUpgrade dtb-amdUpgrade dtb-exynosUpgrade dtb-rockchipUpgrade dtb-hisiliconUpgrade kernel-debugUpgrade gfs2-kmp-defaultUpgrade kernel-debug-vdsoUpgrade dtb-sprd | Aug 14, 2024 | May 17, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-5.4.0-1040-iotUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-6.8.0-1010-oemUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-bluefieldUpgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-gkeop-5.15Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-virtualUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-oem-20.04dUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-oemUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-oracleUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-kvmUpgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-5.4.0-1133-azureUpgrade linux-image-azure-cvmUpgrade linux-image-oem-24.04Upgrade linux-image-oem-20.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-5.4.0-189-genericUpgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-gkeUpgrade linux-image-5.4.0-1128-awsUpgrade linux-image-awsUpgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-oem-24.04aUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-intelUpgrade linux-image-oem-osp1Upgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-116-genericUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-1068-azureUpgrade linux-image-azureUpgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-gcpUpgrade linux-image-lowlatency-64kUpgrade linux-image-oracle-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-116-generic-lpaeUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-raspi2Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-ibm-classicUpgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-gke-5.15Upgrade linux-image-nvidia-64kUpgrade linux-image-gkeop-5.4Upgrade linux-image-generic-64kUpgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-azure-lts-22.04Upgrade linux-image-aws-lts-20.04Upgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-oem-20.04cUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1013-awsUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-nvidiaUpgrade linux-image-genericUpgrade linux-image-5.15.0-1065-aws | Jul 15, 2024 | May 17, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub