In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
The rule activity update delayed work periodically traverses the list of configured rules and queries their activity from the device.
As part of this task it accesses the entry pointed by 'ventry->entry', but this entry can be changed concurrently by the rehash delayed work, leading to a use-after-free [1].
Fix by closing the race and perform the activity query under the 'vregion->lock' mutex.
[1] BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 Read of size 8 at addr ffff8881054ed808 by task kworker/0:18/181
CPU: 0 PID: 181 Comm: kworker/0:18 Not tainted 6.9.0-rc2-custom-00781-gd5ab772d32f7 #2 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 mlxsw_sp_acl_rule_activity_update_work+0x219/0x400 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK>
Allocated by task 1039: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_entry_create+0x7b/0x1f0 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x30d/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
Freed by task 1039: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-zfcpdump-modulesUpgrade kernelUpgrade bpftoolUpgrade kernel-rtUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-rt-develUpgrade kernel-develUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debugUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-cross-headersUpgrade kernel-debugUpgrade kernel-docUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-modules-extraUpgrade kernel-headersUpgrade kernel-debug-develUpgrade kernel-rt-debug-modulesUpgrade kernel-coreUpgrade kernel-modulesUpgrade kernel-debug-coreUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-modules-extraUpgrade perfUpgrade kernel-zfcpdumpUpgrade kernel-rt-core | Jul 3, 2024 | May 17, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernelUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade perf-debuginfoUpgrade perfUpgrade kernel-develUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.216-204.855Upgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade python-perfUpgrade bpftoolUpgrade kernel-headers | Apr 10, 2025 | May 17, 2024 |
| Debian | — | Upgrade linux | Jun 27, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-toolsUpgrade python3-perf | Oct 8, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel | Oct 8, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perf | Oct 9, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libs | Oct 8, 2024 | May 17, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | May 17, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Jul 3, 2024 | May 17, 2024 |
| Rocky_linux | — | Upgrade kernel-cross-headersUpgrade kernel-rtUpgrade python3-perfUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-extraUpgrade kernelUpgrade kernel-headersUpgrade perf-debuginfoUpgrade perfUpgrade kernel-toolsUpgrade kernel-rt-coreUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-debuginfoUpgrade bpftoolUpgrade kernel-debug-modules-extraUpgrade bpftool-debuginfoUpgrade kernel-debug-coreUpgrade kernel-coreUpgrade kernel-rt-develUpgrade kernel-debug-debuginfoUpgrade kernel-debuginfoUpgrade kernel-rt-debug-kvmUpgrade python3-perf-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-develUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-modules-extraUpgrade kernel-modulesUpgrade kernel-debug-modulesUpgrade kernel-debugUpgrade kernel-develUpgrade kernel-rt-debugUpgrade kernel-tools-libsUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-modules-extra | Jul 16, 2024 | May 17, 2024 |
| Suse | — | Upgrade reiserfs-kmp-rtUpgrade kernel-docsUpgrade kernel-obs-buildUpgrade kernel-kvmsmallUpgrade dtb-broadcomUpgrade dtb-armUpgrade kernel-source-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-syms-azureUpgrade kernel-default-base-rebuildUpgrade kernel-devel-azureUpgrade kselftests-kmp-rtUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade cluster-md-kmp-azureUpgrade kernel-default-extraUpgrade kernel-docs-htmlUpgrade ocfs2-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-syms-rtUpgrade kernel-zfcpdumpUpgrade dtb-appleUpgrade dlm-kmp-defaultUpgrade kernel-rt-optionalUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-extraUpgrade kernel-azure-vdsoUpgrade kernel-rt-extraUpgrade kernel-64kb-livepatch-develUpgrade dlm-kmp-azureUpgrade dtb-amlogicUpgrade kernel-rt_debugUpgrade kernel-debug-livepatch-develUpgrade kernel-macrosUpgrade gfs2-kmp-rtUpgrade kernel-rtUpgrade kernel-defaultUpgrade gfs2-kmp-64kbUpgrade kernel-obs-qaUpgrade kernel-kvmsmall-develUpgrade ocfs2-kmp-64kbUpgrade dtb-marvellUpgrade kernel-azure-develUpgrade dtb-apmUpgrade kernel-rt-livepatch-develUpgrade dtb-socionextUpgrade kernel-azure-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade dtb-hisiliconUpgrade kernel-debugUpgrade dtb-alteraUpgrade kernel-rt-develUpgrade gfs2-kmp-azureUpgrade dtb-amazonUpgrade kernel-source-azureUpgrade dtb-allwinnerUpgrade kselftests-kmp-azureUpgrade kernel-debug-develUpgrade kernel-sourceUpgrade kernel-devel-rtUpgrade dtb-mediatekUpgrade dtb-caviumUpgrade ocfs2-kmp-azureUpgrade dtb-exynosUpgrade dtb-rockchipUpgrade kernel-debug-vdsoUpgrade gfs2-kmp-defaultUpgrade kernel-develUpgrade dtb-nvidiaUpgrade kernel-default-develUpgrade kernel-default-baseUpgrade dtb-xilinxUpgrade kernel-azureUpgrade dtb-freescaleUpgrade dtb-qcomUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade dlm-kmp-64kbUpgrade dlm-kmp-rtUpgrade kernel-default-optionalUpgrade kernel-64kb-optionalUpgrade reiserfs-kmp-defaultUpgrade dtb-sprdUpgrade kernel-64kb-extraUpgrade dtb-lgUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kb-develUpgrade dtb-amdUpgrade kernel-source-vanillaUpgrade kernel-symsUpgrade kernel-rt_debug-develUpgrade kselftests-kmp-64kbUpgrade kernel-rt-livepatchUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-azureUpgrade dtb-renesasUpgrade cluster-md-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade kernel-azure-optionalUpgrade kernel-default-livepatchUpgrade kernel-64kb | Aug 14, 2024 | May 17, 2024 |
| Ubuntu | — | Upgrade linux-image-oracle-64kUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-1013-awsUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-oem-20.04cUpgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-aws-lts-20.04Upgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-ibm-classicUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-raspiUpgrade linux-image-gkeopUpgrade linux-image-azureUpgrade linux-image-azure-fdeUpgrade linux-image-intelUpgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-6.8.0-1012-azureUpgrade linux-image-gcpUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-generic-lpaeUpgrade linux-image-oem-20.04bUpgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-5.15.0-116-generic-lpaeUpgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-raspi2Upgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-5.15.0-1068-azureUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-azure-lts-20.04Upgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-nvidiaUpgrade linux-image-ibmUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.15.0-1065-awsUpgrade linux-image-oem-osp1Upgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-genericUpgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-116-genericUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-generic-64kUpgrade linux-image-gkeop-5.4Upgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1010-oemUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-oemUpgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.4.0-1040-iotUpgrade linux-image-nvidia-6.8Upgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-bluefieldUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-20.04Upgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-awsUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-raspi-nolpaeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.4.0-1133-azureUpgrade linux-image-oem-24.04Upgrade linux-image-azure-cvmUpgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-kvmUpgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-gkeop-5.15Upgrade linux-image-virtualUpgrade linux-image-gkeUpgrade linux-image-5.4.0-1128-awsUpgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-5.4.0-189-genericUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-oracle | Jul 15, 2024 | May 17, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub