In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
The rule activity update delayed work periodically traverses the list of configured rules and queries their activity from the device.
As part of this task it accesses the entry pointed by 'ventry->entry', but this entry can be changed concurrently by the rehash delayed work, leading to a use-after-free [1].
Fix by closing the race and perform the activity query under the 'vregion->lock' mutex.
[1] BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 Read of size 8 at addr ffff8881054ed808 by task kworker/0:18/181
CPU: 0 PID: 181 Comm: kworker/0:18 Not tainted 6.9.0-rc2-custom-00781-gd5ab772d32f7 #2 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 mlxsw_sp_acl_rule_activity_update_work+0x219/0x400 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK>
Allocated by task 1039: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_entry_create+0x7b/0x1f0 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x30d/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
Freed by task 1039: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-rt-kvmUpgrade kernel-rtUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftoolUpgrade kernel-rt-modules-extraUpgrade kernel-toolsUpgrade kernel-rt-debugUpgrade kernel-develUpgrade python3-perfUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libs-develUpgrade kernel-rt-develUpgrade kernel-rt-debug-develUpgrade kernel-rt-modulesUpgrade kernel-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-kvmUpgrade perfUpgrade kernel-docUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-develUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade kernel-debug-coreUpgrade kernel-headersUpgrade kernel-coreUpgrade kernel-rt-core | Jul 3, 2024 | May 17, 2024 |
| Amazon Linux Ami 2 | — | Upgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-toolsUpgrade kernel-livepatch-5.10.216-204.855Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernel-tools-develUpgrade perfUpgrade perf-debuginfoUpgrade kernelUpgrade kernel-debuginfo | Apr 10, 2025 | May 17, 2024 |
| Debian | — | Upgrade linux | Jun 27, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-abi-stablelists | Oct 8, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftoolUpgrade kernel-tools | Oct 8, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-libs | Oct 9, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel | Oct 8, 2024 | May 17, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | May 17, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Jul 3, 2024 | May 17, 2024 |
| Rocky_linux | — | Upgrade kernel-toolsUpgrade kernel-headersUpgrade perfUpgrade kernel-cross-headersUpgrade kernelUpgrade kernel-rtUpgrade perf-debuginfoUpgrade kernel-rt-modules-extraUpgrade python3-perfUpgrade kernel-tools-libs-develUpgrade kernel-debug-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-tools-libsUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade python3-perf-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debug-modules-extraUpgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-modules-extraUpgrade kernel-modulesUpgrade kernel-debug-modulesUpgrade kernel-debugUpgrade kernel-rt-debug-modulesUpgrade kernel-develUpgrade kernel-rt-modulesUpgrade kernel-rt-coreUpgrade kernel-rt-debuginfoUpgrade kernel-debuginfoUpgrade kernel-rt-debugUpgrade kernel-coreUpgrade kernel-rt-develUpgrade kernel-debug-debuginfoUpgrade kernel-debug-core | Jul 16, 2024 | May 17, 2024 |
| Suse | — | Upgrade kernel-default-baseUpgrade dtb-lgUpgrade kernel-symsUpgrade kselftests-kmp-64kbUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-debug-develUpgrade kernel-source-vanillaUpgrade dtb-sprdUpgrade ocfs2-kmp-defaultUpgrade dtb-freescaleUpgrade kernel-develUpgrade dtb-nvidiaUpgrade dtb-xilinxUpgrade kselftests-kmp-azureUpgrade dtb-allwinnerUpgrade dtb-caviumUpgrade kernel-devel-rtUpgrade kernel-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-debugUpgrade dtb-qcomUpgrade kernel-64kb-extraUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-azure-optionalUpgrade kernel-default-livepatchUpgrade kernel-azureUpgrade dtb-alteraUpgrade gfs2-kmp-azureUpgrade kernel-default-optionalUpgrade dtb-amdUpgrade kernel-rt-livepatchUpgrade dtb-hisiliconUpgrade dtb-rockchipUpgrade kernel-default-livepatch-develUpgrade dtb-exynosUpgrade dtb-renesasUpgrade kernel-default-develUpgrade kernel-sourceUpgrade kernel-64kb-optionalUpgrade cluster-md-kmp-rtUpgrade dtb-amazonUpgrade dlm-kmp-64kbUpgrade dlm-kmp-rtUpgrade kernel-source-azureUpgrade kernel-rt-develUpgrade dtb-mediatekUpgrade kernel-rt_debug-develUpgrade gfs2-kmp-rtUpgrade dtb-appleUpgrade kernel-default-base-rebuildUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade kernel-kvmsmallUpgrade kernel-obs-buildUpgrade dtb-broadcomUpgrade kernel-default-extraUpgrade kernel-syms-azureUpgrade kernel-docsUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-livepatch-develUpgrade kernel-zfcpdumpUpgrade kernel-syms-rtUpgrade kernel-rtUpgrade kernel-64kb-livepatch-develUpgrade ocfs2-kmp-rtUpgrade dlm-kmp-azureUpgrade kernel-rt_debugUpgrade kernel-macrosUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-azure-livepatch-develUpgrade dtb-amlogicUpgrade dtb-apmUpgrade kselftests-kmp-defaultUpgrade kernel-azure-extraUpgrade kernel-azure-vdsoUpgrade dtb-socionextUpgrade kernel-rt-optionalUpgrade kernel-source-rtUpgrade kernel-rt-extraUpgrade dtb-armUpgrade dlm-kmp-defaultUpgrade kernel-docs-htmlUpgrade ocfs2-kmp-64kbUpgrade dtb-marvellUpgrade kernel-defaultUpgrade kernel-azure-develUpgrade gfs2-kmp-64kbUpgrade kernel-obs-qaUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-devel-azureUpgrade kernel-debug-livepatch-devel | Aug 14, 2024 | May 17, 2024 |
| Ubuntu | — | Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-generic-64kUpgrade linux-image-genericUpgrade linux-image-5.15.0-1065-awsUpgrade linux-image-nvidiaUpgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-oem-osp1Upgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-lowlatencyUpgrade linux-image-azure-lts-22.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-nvidia-64kUpgrade linux-image-aws-lts-20.04Upgrade linux-image-azureUpgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-intel-iotgUpgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.15.0-116-generic-lpaeUpgrade linux-image-6.8.0-1013-awsUpgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-ibmUpgrade linux-image-gke-5.15Upgrade linux-image-azure-fdeUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-64kUpgrade linux-image-gcpUpgrade linux-image-oracle-64kUpgrade linux-image-ibm-classicUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-6.8.0-1012-azureUpgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-raspiUpgrade linux-image-intelUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-raspi2Upgrade linux-image-5.15.0-116-genericUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-gkeopUpgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-5.15.0-1068-azureUpgrade linux-image-gkeop-5.4Upgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oracleUpgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.4.0-189-genericUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-oem-20.04dUpgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-6.8.0-1010-oemUpgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-gkeop-5.15Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-gkeUpgrade linux-image-5.4.0-1128-awsUpgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-awsUpgrade linux-image-virtualUpgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-5.4.0-1133-azureUpgrade linux-image-azure-cvmUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-kvmUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-oem-20.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-oemUpgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-5.4.0-1040-iotUpgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-bluefield | Jul 15, 2024 | May 17, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub