CVE-2023-52487

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-52487
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52487.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-52487
Related
Published
2024-03-11T18:15:16Z
Modified
2024-09-18T03:21:35.023893Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix peer flow lists handling

The cited change refactored mlx5etcdelfdbpeerflow() to only clear DUP flag when list of peer flows has become empty. However, if any concurrent user holds a reference to a peer flow (for example, the neighbor update workqueue task is updating peer flow's parent encap entry concurrently), then the flow will not be removed from the peer list and, consecutively, DUP flag will remain set. Since mlx5etcdelfdbpeersflow() calls mlx5etcdelfdbpeerflow() for every possible peer index the algorithm will try to remove the flow from eswitch instances that it has never peered with causing either NULL pointer dereference when trying to remove the flow peer list head of peerindex that was never initialized or a warning if the list debug config is enabled[0].

Fix the issue by always removing the peer flow from the list even when not releasing the last reference to it.

[0]:

[ 3102.985806] ------------[ cut here ]------------ [ 3102.986223] listdel corruption, ffff888139110698->next is NULL [ 3102.986757] WARNING: CPU: 2 PID: 22109 at lib/listdebug.c:53 listdelentryvalidorreport+0x4f/0xc0 [ 3102.987561] Modules linked in: actct nfflowtable bonding acttunnelkey actmirred actskbedit vxlan clsmatchall nfnetlinkcttimeout actgact clsflower schingress mlx5vdpa vringh vhostiotlb vdpa openvswitch nsh xtMASQUERADE nfconntracknetlink nfnetlink iptablenat xtaddrtype xtconntrack nfnat brnetfilter rpcsecgsskrb5 authrpcg ss oidregistry overlay rpcrdma rdmaucm ibiser libiscsi scsitransportiscsi ibumad rdmacm ibipoib iwcm ibcm mlx5ib ibuverbs ibcore mlx5core [last unloaded: bonding] [ 3102.991113] CPU: 2 PID: 22109 Comm: revalidator28 Not tainted 6.6.0-rc6+ #3 [ 3102.991695] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 3102.992605] RIP: 0010:listdelentryvalidorreport+0x4f/0xc0 [ 3102.993122] Code: 39 c2 74 56 48 8b 32 48 39 fe 75 62 48 8b 51 08 48 39 f2 75 73 b8 01 00 00 00 c3 48 89 fe 48 c7 c7 48 fd 0a 82 e8 41 0b ad ff <0f> 0b 31 c0 c3 48 89 fe 48 c7 c7 70 fd 0a 82 e8 2d 0b ad ff 0f 0b [ 3102.994615] RSP: 0018:ffff8881383e7710 EFLAGS: 00010286 [ 3102.995078] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 [ 3102.995670] RDX: 0000000000000001 RSI: ffff88885f89b640 RDI: ffff88885f89b640 [ 3102.997188] DEL flow 00000000be367878 on port 0 [ 3102.998594] RBP: dead000000000122 R08: 0000000000000000 R09: c0000000ffffdfff [ 3102.999604] R10: 0000000000000008 R11: ffff8881383e7598 R12: dead000000000100 [ 3103.000198] R13: 0000000000000002 R14: ffff888139110000 R15: ffff888101901240 [ 3103.000790] FS: 00007f424cde4700(0000) GS:ffff88885f880000(0000) knlGS:0000000000000000 [ 3103.001486] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3103.001986] CR2: 00007fd42e8dcb70 CR3: 000000011e68a003 CR4: 0000000000370ea0 [ 3103.002596] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3103.003190] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 3103.003787] Call Trace: [ 3103.004055] <TASK> [ 3103.004297] ? _warn+0x7d/0x130 [ 3103.004623] ? _listdelentryvalidorreport+0x4f/0xc0 [ 3103.005094] ? reportbug+0xf1/0x1c0 [ 3103.005439] ? consoleunlock+0x4a/0xd0 [ 3103.005806] ? handlebug+0x3f/0x70 [ 3103.006149] ? excinvalidop+0x13/0x60 [ 3103.006531] ? asmexcinvalidop+0x16/0x20 [ 3103.007430] ? _listdelentryvalidorreport+0x4f/0xc0 [ 3103.007910] mlx5etcdelfdbpeersflow+0xcf/0x240 [mlx5core] [ 3103.008463] mlx5etcdelflow+0x46/0x270 [mlx5core] [ 3103.008944] mlx5eflowput+0x26/0x50 [mlx5core] [ 3103.009401] mlx5edeleteflower+0x25f/0x380 [mlx5core] [ 3103.009901] tcsetupcbdestroy+0xab/0x180 [ 3103.010292] flhwdestroyfilter+0x99/0xc0 [clsflower] [ 3103.010779] _fldelete+0x2d4/0x2f0 [clsflower] [ 3103.0 ---truncated---

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.6.15-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1
6.6.8-1
6.6.9-1
6.6.11-1
6.6.13-1~bpo12+1
6.6.13-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}