In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_acl_erp: Fix object nesting warning
ACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM (A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can contain more ACLs (i.e., tc filters), but the number of masks in each region (i.e., tc chain) is limited.
In order to mitigate the effects of the above limitation, the device allows filters to share a single mask if their masks only differ in up to 8 consecutive bits. For example, dst_ip/25 can be represented using dst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the number of masks being used (and therefore does not support mask aggregation), but can contain a limited number of filters.
The driver uses the "objagg" library to perform the mask aggregation by passing it objects that consist of the filter's mask and whether the filter is to be inserted into the A-TCAM or the C-TCAM since filters in different TCAMs cannot share a mask.
The set of created objects is dependent on the insertion order of the filters and is not necessarily optimal. Therefore, the driver will periodically ask the library to compute a more optimal set ("hints") by looking at all the existing objects.
When the library asks the driver whether two objects can be aggregated the driver only compares the provided masks and ignores the A-TCAM / C-TCAM indication. This is the right thing to do since the goal is to move as many filters as possible to the A-TCAM. The driver also forbids two identical masks from being aggregated since this can only happen if one was intentionally put in the C-TCAM to avoid a conflict in the A-TCAM.
The above can result in the following set of hints:
H1: {mask X, A-TCAM} -> H2: {mask Y, A-TCAM} // X is Y + delta H3: {mask Y, C-TCAM} -> H4: {mask Z, A-TCAM} // Y is Z + delta
After getting the hints from the library the driver will start migrating filters from one region to another while consulting the computed hints and instructing the device to perform a lookup in both regions during the transition.
Assuming a filter with mask X is being migrated into the A-TCAM in the new region, the hints lookup will return H1. Since H2 is the parent of H1, the library will try to find the object associated with it and create it if necessary in which case another hints lookup (recursive) will be performed. This hints lookup for {mask Y, A-TCAM} will either return H2 or H3 since the driver passes the library an object comparison function that ignores the A-TCAM / C-TCAM indication.
This can eventually lead to nested objects which are not supported by the library [1].
Fix by removing the object comparison function from both the driver and the library as the driver was the only user. That way the lookup will only return exact matches.
I do not have a reliable reproducer that can reproduce the issue in a timely manner, but before the fix the issue would reproduce in several minutes and with the fix it does not reproduce in over an hour.
Note that the current usefulness of the hints is limited because they include the C-TCAM indication and represent aggregation that cannot actually happen. This will be addressed in net-next.
[1] WARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0 Modules linked in: CPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42 Hardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:objagg_obj_parent_assign+0xb5/0xd0 [...] Call Trace: <TASK> __objagg_obj_get+0x2bb/0x580 objagg_obj_get+0xe/0x80 mlxsw_sp_acl_erp_mask_get+0xb5/0xf0 mlxsw_sp_acl_atcam_entry_add+0xe8/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x370
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-docUpgrade python3-perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-develUpgrade kernel-headersUpgrade perfUpgrade kernel-rt-coreUpgrade kernel-rt-modulesUpgrade kernel-debug-develUpgrade kernel-abi-stablelistsUpgrade kernel-modulesUpgrade kernel-cross-headersUpgrade kernel-debug-modules-extraUpgrade kernel-rtUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdumpUpgrade kernel-debugUpgrade kernel-debug-coreUpgrade kernel-rt-debugUpgrade kernel-develUpgrade kernel-debug-modulesUpgrade kernelUpgrade kernel-rt-develUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-tools-libsUpgrade kernel-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-modules-extraUpgrade bpftoolUpgrade kernel-modules-extraUpgrade kernel-tools | Nov 7, 2024 | Aug 21, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernelUpgrade kernel-tools-develUpgrade python-perfUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.224-212.876Upgrade perfUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade python-perf-debuginfo | Sep 5, 2024 | Aug 21, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Sep 2, 2024 | Aug 21, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools-libsUpgrade bpftoolUpgrade python3-perf | Dec 12, 2024 | Aug 21, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade python3-perf | Dec 12, 2024 | Aug 21, 2024 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Oct 16, 2024 | Aug 21, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Nov 6, 2024 | Aug 21, 2024 |
| Rocky_linux | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-coreUpgrade kernelUpgrade kernel-cross-headersUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-tools-libsUpgrade kernel-debug-develUpgrade kernel-headersUpgrade kernel-tools-libs-develUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-debug-debuginfoUpgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-modulesUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debug-coreUpgrade perfUpgrade kernel-rt-develUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-rt-coreUpgrade python3-perf-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-modules-extraUpgrade kernel-rt-modulesUpgrade perf-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-develUpgrade kernel-rtUpgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade kernel-debugUpgrade kernel-rt-debug | Nov 19, 2024 | Aug 21, 2024 |
| Suse | — | Upgrade dtb-mediatekUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-default-optionalUpgrade kernel-default-livepatch-develUpgrade kernel-debugUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-caviumUpgrade dtb-sprdUpgrade kernel-rt-develUpgrade dtb-armUpgrade kernel-docsUpgrade kernel-rt-optionalUpgrade dtb-rockchipUpgrade dtb-allwinnerUpgrade dtb-nvidiaUpgrade cluster-md-kmp-azureUpgrade kernel-docs-htmlUpgrade kernel-default-vdsoUpgrade kernel-macrosUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-alteraUpgrade kernel-azure-optionalUpgrade kernel-rt-livepatchUpgrade kernel-syms-azureUpgrade gfs2-kmp-rtUpgrade kselftests-kmp-64kbUpgrade kernel-64kb-develUpgrade kernel-64kb-optionalUpgrade kernel-source-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-sourceUpgrade kernel-azure-extraUpgrade kernel-kvmsmall-develUpgrade ocfs2-kmp-64kbUpgrade dtb-amlogicUpgrade kernel-azure-develUpgrade kernel-default-base-rebuildUpgrade kernel-kvmsmallUpgrade dtb-lgUpgrade kernel-obs-qaUpgrade kernel-syms-rtUpgrade dtb-freescaleUpgrade cluster-md-kmp-defaultUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-livepatch-develUpgrade kernel-symsUpgrade kernel-azure-livepatch-develUpgrade kernel-default-develUpgrade kernel-rt_debug-vdsoUpgrade dtb-amazonUpgrade dtb-apmUpgrade dtb-exynosUpgrade kernel-rtUpgrade ocfs2-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade dtb-broadcomUpgrade gfs2-kmp-64kbUpgrade kernel-azure-vdsoUpgrade kernel-default-livepatchUpgrade dtb-qcomUpgrade kernel-devel-azureUpgrade dtb-hisiliconUpgrade kernel-devel-rtUpgrade kernel-64kbUpgrade kernel-zfcpdumpUpgrade kernel-default-extraUpgrade kernel-debug-vdsoUpgrade kernel-debug-develUpgrade cluster-md-kmp-rtUpgrade kernel-rt-vdsoUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debugUpgrade kernel-obs-buildUpgrade kernel-rt-extraUpgrade kernel-default-baseUpgrade dtb-marvellUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-rtUpgrade kernel-defaultUpgrade kernel-azureUpgrade gfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-rt_debug-develUpgrade dtb-amdUpgrade dtb-renesasUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-develUpgrade dlm-kmp-defaultUpgrade dlm-kmp-azureUpgrade kernel-64kb-extraUpgrade dtb-xilinxUpgrade dtb-socionextUpgrade dtb-appleUpgrade dlm-kmp-rtUpgrade kernel-source-rtUpgrade gfs2-kmp-default | Dec 5, 2025 | Nov 8, 2024 |
| Ubuntu | — | Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-oem-22.04bUpgrade linux-image-5.4.0-200-genericUpgrade linux-image-5.15.0-1070-oracleUpgrade linux-image-nvidiaUpgrade linux-image-ibmUpgrade linux-image-azure-lts-22.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.4.0-1134-oracleUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.15.0-1069-kvmUpgrade linux-image-5.4.0-1044-iotUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1071-gcpUpgrade linux-image-lowlatencyUpgrade linux-image-ibm-classicUpgrade linux-image-gcpUpgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-kvmUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-virtualUpgrade linux-image-5.4.0-1094-bluefieldUpgrade linux-image-5.15.0-1075-azureUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.4.0-1135-awsUpgrade linux-image-oem-osp1Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-5.15.0-1065-raspiUpgrade linux-image-oem-22.04cUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-genericUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1067-intel-iotgUpgrade linux-image-5.15.0-125-genericUpgrade linux-image-oem-20.04dUpgrade linux-image-gkeop-5.4Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-oem-24.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-125-lowlatencyUpgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-nvidia-64kUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.15.0-125-generic-lpaeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1020-azureUpgrade linux-image-oem-20.04Upgrade linux-image-5.4.0-200-generic-lpaeUpgrade linux-image-5.15.0-125-lowlatency-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-raspi2Upgrade linux-image-gkeopUpgrade linux-image-gkeUpgrade linux-image-oracle-64kUpgrade linux-image-azureUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-generic-64kUpgrade linux-image-intelUpgrade linux-image-oem-20.04cUpgrade linux-image-raspiUpgrade linux-image-5.4.0-1082-ibmUpgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-6.8.0-50-genericUpgrade linux-image-5.4.0-1102-gkeopUpgrade linux-image-5.15.0-125-generic-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1038-xilinx-zynqmpUpgrade linux-image-generic-lpaeUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-5.4.0-200-lowlatencyUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.4.0-1123-kvmUpgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-5.15.0-1078-azureUpgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.15.0-1065-ibmUpgrade linux-image-oracleUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.8.0-1018-oemUpgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-5.15.0-1069-gkeUpgrade linux-image-azure-cvmUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oem-22.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-bluefieldUpgrade linux-image-awsUpgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-5.4.0-1140-azureUpgrade linux-image-5.4.0-1139-gcpUpgrade linux-image-5.4.0-1119-raspiUpgrade linux-image-5.15.0-1072-awsUpgrade linux-image-5.15.0-1067-nvidia-lowlatencyUpgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.4.0-1139-azureUpgrade linux-image-6.8.0-1020-awsUpgrade linux-image-azure-lts-20.04Upgrade linux-image-aws-lts-20.04Upgrade linux-image-5.15.0-1055-gkeopUpgrade linux-image-nvidia-6.8Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-oemUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-gke-5.15Upgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-azure-fdeUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.4.0-1054-xilinx-zynqmpUpgrade linux-image-5.15.0-1067-nvidia | Nov 4, 2024 | Aug 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub