In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
The rule activity update delayed work periodically traverses the list of configured rules and queries their activity from the device.
As part of this task it accesses the entry pointed by 'ventry->entry', but this entry can be changed concurrently by the rehash delayed work, leading to a use-after-free [1].
Fix by closing the race and perform the activity query under the 'vregion->lock' mutex.
[1] BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 Read of size 8 at addr ffff8881054ed808 by task kworker/0:18/181
CPU: 0 PID: 181 Comm: kworker/0:18 Not tainted 6.9.0-rc2-custom-00781-gd5ab772d32f7 #2 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 mlxsw_sp_acl_rule_activity_update_work+0x219/0x400 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK>
Allocated by task 1039: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_entry_create+0x7b/0x1f0 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x30d/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
Freed by task 1039: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-develUpgrade kernel-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-develUpgrade kernel-debug-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-develUpgrade perfUpgrade kernel-rt-modulesUpgrade kernel-docUpgrade kernel-headersUpgrade kernel-coreUpgrade kernel-debug-modules-extraUpgrade kernel-debugUpgrade kernel-modules-extraUpgrade kernel-toolsUpgrade kernel-tools-libs-develUpgrade kernelUpgrade kernel-cross-headersUpgrade kernel-rt-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-develUpgrade kernel-rt-debugUpgrade kernel-rt-debug-coreUpgrade bpftoolUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-rtUpgrade kernel-rt-kvmUpgrade kernel-zfcpdump-core | Jul 3, 2024 | May 17, 2024 |
| Amazon Linux Ami 2 | — | Upgrade perfUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade kernel-develUpgrade kernel-livepatch-5.10.216-204.855Upgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade python-perfUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade python-perf-debuginfo | Apr 10, 2025 | May 17, 2024 |
| Debian | — | Upgrade linux | Jun 27, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools-libs | Oct 8, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernelUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade python3-perf | Oct 8, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelists | Oct 9, 2024 | May 17, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel | Oct 8, 2024 | May 17, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | May 17, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Jul 3, 2024 | May 17, 2024 |
| Rocky_linux | — | Upgrade python3-perfUpgrade perfUpgrade kernel-cross-headersUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-rt-modules-extraUpgrade kernelUpgrade kernel-rtUpgrade kernel-headersUpgrade kernel-tools-libs-develUpgrade kernel-tools-libsUpgrade kernel-debugUpgrade kernel-modulesUpgrade kernel-rt-debugUpgrade bpftool-debuginfoUpgrade kernel-debug-coreUpgrade kernel-coreUpgrade kernel-debug-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-modules-extraUpgrade bpftoolUpgrade kernel-rt-kvmUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debug-kvmUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-develUpgrade kernel-rt-devel | Jul 16, 2024 | May 17, 2024 |
| Suse | — | Upgrade kernel-default-base-rebuildUpgrade kernel-defaultUpgrade kselftests-kmp-rtUpgrade dtb-appleUpgrade kernel-rt-vdsoUpgrade gfs2-kmp-64kbUpgrade dtb-amlogicUpgrade cluster-md-kmp-defaultUpgrade kernel-default-extraUpgrade kernel-docs-htmlUpgrade kernel-azure-develUpgrade kernel-obs-qaUpgrade dtb-marvellUpgrade kernel-obs-buildUpgrade reiserfs-kmp-rtUpgrade dtb-broadcomUpgrade kernel-docsUpgrade kernel-64kb-livepatch-develUpgrade kernel-zfcpdumpUpgrade ocfs2-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-syms-rtUpgrade kernel-devel-azureUpgrade kernel-syms-azureUpgrade gfs2-kmp-rtUpgrade kernel-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt_debug-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-optionalUpgrade kernel-azure-vdsoUpgrade kernel-rt-extraUpgrade kernel-azure-extraUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-defaultUpgrade dtb-armUpgrade dtb-socionextUpgrade kernel-azure-livepatch-develUpgrade kernel-kvmsmall-develUpgrade dlm-kmp-azureUpgrade kernel-kvmsmallUpgrade kernel-macrosUpgrade kernel-rt_debugUpgrade kernel-source-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-apmUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-azureUpgrade dtb-rockchipUpgrade kernel-debugUpgrade gfs2-kmp-azureUpgrade kernel-64kbUpgrade ocfs2-kmp-defaultUpgrade kernel-develUpgrade kernel-default-develUpgrade kernel-default-baseUpgrade kernel-azureUpgrade dtb-xilinxUpgrade dtb-qcomUpgrade dtb-nvidiaUpgrade dtb-freescaleUpgrade kernel-rt_debug-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade kernel-64kb-optionalUpgrade dtb-sprdUpgrade dlm-kmp-rtUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade kernel-source-vanillaUpgrade kernel-default-optionalUpgrade kernel-debug-vdsoUpgrade gfs2-kmp-defaultUpgrade dtb-hisiliconUpgrade dtb-exynosUpgrade dtb-amazonUpgrade kernel-source-azureUpgrade kernel-rt-develUpgrade dtb-alteraUpgrade kernel-azure-optionalUpgrade kernel-64kb-develUpgrade dtb-renesasUpgrade dtb-amdUpgrade reiserfs-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade kselftests-kmp-azureUpgrade kernel-sourceUpgrade kernel-devel-rtUpgrade kernel-debug-develUpgrade dtb-mediatekUpgrade dtb-caviumUpgrade dtb-allwinnerUpgrade dtb-lgUpgrade kselftests-kmp-64kbUpgrade kernel-symsUpgrade kernel-rt_debug-develUpgrade kernel-rt-livepatchUpgrade kernel-default-vdsoUpgrade kernel-default-livepatchUpgrade kernel-64kb-extra | Aug 14, 2024 | May 17, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-gkeop-5.15Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.4.0-1128-awsUpgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-awsUpgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-5.4.0-1040-iotUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-virtualUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-oem-24.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-6.8.0-1010-oemUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-nvidia-6.8Upgrade linux-image-oemUpgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-oracleUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-5.4.0-1133-azureUpgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-oem-20.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-kvmUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.4.0-189-genericUpgrade linux-image-bluefieldUpgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-gkeUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-1068-azureUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-116-generic-lpaeUpgrade linux-image-lowlatency-64kUpgrade linux-image-gcpUpgrade linux-image-oracle-64kUpgrade linux-image-intelUpgrade linux-image-ibm-classicUpgrade linux-image-raspiUpgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-5.15.0-1065-awsUpgrade linux-image-nvidiaUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-ibmUpgrade linux-image-oem-20.04cUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-oem-osp1Upgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-lowlatencyUpgrade linux-image-aws-lts-20.04Upgrade linux-image-genericUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-raspi2Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-oem-24.04aUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.8.0-1013-awsUpgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-azure-lts-20.04Upgrade linux-image-intel-iotgUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-5.15.0-116-genericUpgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-oem-20.04bUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-generic-64kUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-gkeop-5.4Upgrade linux-image-nvidia-64kUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-gkeopUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-azure | Jul 15, 2024 | May 17, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub