In the Linux kernel, the following vulnerability has been resolved:
team: fix null-ptr-deref when team device type is changed
Get a null-ptr-deref bug as follows with reproducer [1].
BUG: kernel NULL pointer dereference, address: 0000000000000228 ... RIP: 0010:vlandevhardheader+0x35/0x140 [8021q] ... Call Trace: <TASK> ? _die+0x24/0x70 ? pagefaultoops+0x82/0x150 ? excpagefault+0x69/0x150 ? asmexcpagefault+0x26/0x30 ? vlandevhardheader+0x35/0x140 [8021q] ? vlandevhardheader+0x8e/0x140 [8021q] neighconnectedoutput+0xb2/0x100 ip6finishoutput2+0x1cb/0x520 ? nfhookslow+0x43/0xc0 ? ip6mtu+0x46/0x80 ip6finishoutput+0x2a/0xb0 mldsendpack+0x18f/0x250 mldifcwork+0x39/0x160 processonework+0x1e6/0x3f0 workerthread+0x4d/0x2f0 ? _pfxworkerthread+0x10/0x10 kthread+0xe5/0x120 ? _pfxkthread+0x10/0x10 retfromfork+0x34/0x50 ? _pfxkthread+0x10/0x10 retfromforkasm+0x1b/0x30
[1] $ teamd -t team0 -d -c '{"runner": {"name": "loadbalance"}}' $ ip link add name t-dummy type dummy $ ip link add link t-dummy name t-dummy.100 type vlan id 100 $ ip link add name t-nlmon type nlmon $ ip link set t-nlmon master team0 $ ip link set t-nlmon nomaster $ ip link set t-dummy up $ ip link set team0 up $ ip link set t-dummy.100 down $ ip link set t-dummy.100 master team0
When enslave a vlan device to team device and team device type is changed from non-ether to ether, headerops of team device is changed to vlanheaderops. That is incorrect and will trigger null-ptr-deref for vlan->realdev in vlandevhard_header() because team device is not a vlan device.
Cache ethheaderops in teamsetup(), then assign cached headerops to header_ops of team net device when its type is changed from non-ether to ether to fix the bug.
[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"58466714574711081973871212898881575716",
"14081376067144396504301549215720115235",
"317729735304802125846673714205658180328",
"25921442780430946876446846096494132965",
"157374768807426339696960807617585494947",
"131434261467451809041628166815452332574",
"321766604170215602577270242947670338919",
"232218966429843369729092732722083348927",
"23804693792155640436994265998586518637",
"332572749335404922897488099069078647769"
]
},
"target": {
"file": "drivers/net/team/team.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b44dd92e2afd89eb6e9d27616858e72a67bdc1a7",
"id": "CVE-2023-52574-05320e43",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "10814261026284728307388336407618140569",
"length": 785.0
},
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup_by_port"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f0acb0736ecc3eb85dc80ad2790d634dcb10b58",
"id": "CVE-2023-52574-056e7c5e",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260689445606164492464611624250147724855",
"283233440538128571245282378544239102934",
"132673494665694999360453569736095819998"
]
},
"target": {
"file": "include/linux/if_team.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@492032760127251e5540a5716a70996bacf2a3fd",
"id": "CVE-2023-52574-06548fa2",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "55732945693060538177700984865358513597",
"length": 929.0
},
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5f6478686bb45f453031594ae19b6c9723a780d",
"id": "CVE-2023-52574-1654b9d6",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"58466714574711081973871212898881575716",
"14081376067144396504301549215720115235",
"317729735304802125846673714205658180328",
"25921442780430946876446846096494132965",
"157374768807426339696960807617585494947",
"131434261467451809041628166815452332574",
"321766604170215602577270242947670338919",
"232218966429843369729092732722083348927",
"23804693792155640436994265998586518637",
"332572749335404922897488099069078647769"
]
},
"target": {
"file": "drivers/net/team/team.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5f6478686bb45f453031594ae19b6c9723a780d",
"id": "CVE-2023-52574-2a2e0209",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"58466714574711081973871212898881575716",
"14081376067144396504301549215720115235",
"317729735304802125846673714205658180328",
"25921442780430946876446846096494132965",
"157374768807426339696960807617585494947",
"131434261467451809041628166815452332574",
"321766604170215602577270242947670338919",
"232218966429843369729092732722083348927",
"23804693792155640436994265998586518637",
"332572749335404922897488099069078647769"
]
},
"target": {
"file": "drivers/net/team/team.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1779eb51b9cc628cee551f252701a85a2a50a457",
"id": "CVE-2023-52574-2ebff397",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "10814261026284728307388336407618140569",
"length": 785.0
},
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup_by_port"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1779eb51b9cc628cee551f252701a85a2a50a457",
"id": "CVE-2023-52574-34604584",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260689445606164492464611624250147724855",
"283233440538128571245282378544239102934",
"132673494665694999360453569736095819998"
]
},
"target": {
"file": "include/linux/if_team.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7fb47b9711101d2405b0eb1276fb1f9b9b270c7",
"id": "CVE-2023-52574-399cf8db",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260689445606164492464611624250147724855",
"283233440538128571245282378544239102934",
"132673494665694999360453569736095819998"
]
},
"target": {
"file": "include/linux/if_team.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5f6478686bb45f453031594ae19b6c9723a780d",
"id": "CVE-2023-52574-465ed4e6",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260689445606164492464611624250147724855",
"283233440538128571245282378544239102934",
"132673494665694999360453569736095819998"
]
},
"target": {
"file": "include/linux/if_team.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b44dd92e2afd89eb6e9d27616858e72a67bdc1a7",
"id": "CVE-2023-52574-50416f97",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260689445606164492464611624250147724855",
"283233440538128571245282378544239102934",
"132673494665694999360453569736095819998"
]
},
"target": {
"file": "include/linux/if_team.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1779eb51b9cc628cee551f252701a85a2a50a457",
"id": "CVE-2023-52574-52257b4a",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "21587549419069229727376995021793684392",
"length": 908.0
},
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@492032760127251e5540a5716a70996bacf2a3fd",
"id": "CVE-2023-52574-5c5e2b58",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "21587549419069229727376995021793684392",
"length": 908.0
},
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd05eec2ee0cc396813a32ef675634e403748255",
"id": "CVE-2023-52574-60e4c53c",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "10814261026284728307388336407618140569",
"length": 785.0
},
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup_by_port"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5f6478686bb45f453031594ae19b6c9723a780d",
"id": "CVE-2023-52574-6f23ad45",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260689445606164492464611624250147724855",
"283233440538128571245282378544239102934",
"132673494665694999360453569736095819998"
]
},
"target": {
"file": "include/linux/if_team.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f0acb0736ecc3eb85dc80ad2790d634dcb10b58",
"id": "CVE-2023-52574-7a40379d",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "247299827902645496717348148260472819896",
"length": 882.0
},
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1779eb51b9cc628cee551f252701a85a2a50a457",
"id": "CVE-2023-52574-8006de6c",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"58466714574711081973871212898881575716",
"14081376067144396504301549215720115235",
"317729735304802125846673714205658180328",
"25921442780430946876446846096494132965",
"157374768807426339696960807617585494947",
"131434261467451809041628166815452332574",
"321766604170215602577270242947670338919",
"232218966429843369729092732722083348927",
"23804693792155640436994265998586518637",
"332572749335404922897488099069078647769"
]
},
"target": {
"file": "drivers/net/team/team.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@492032760127251e5540a5716a70996bacf2a3fd",
"id": "CVE-2023-52574-969a2ac8",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"58466714574711081973871212898881575716",
"14081376067144396504301549215720115235",
"317729735304802125846673714205658180328",
"25921442780430946876446846096494132965",
"157374768807426339696960807617585494947",
"131434261467451809041628166815452332574",
"321766604170215602577270242947670338919",
"232218966429843369729092732722083348927",
"23804693792155640436994265998586518637",
"332572749335404922897488099069078647769"
]
},
"target": {
"file": "drivers/net/team/team.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd05eec2ee0cc396813a32ef675634e403748255",
"id": "CVE-2023-52574-9870f314",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"58466714574711081973871212898881575716",
"14081376067144396504301549215720115235",
"317729735304802125846673714205658180328",
"25921442780430946876446846096494132965",
"157374768807426339696960807617585494947",
"131434261467451809041628166815452332574",
"321766604170215602577270242947670338919",
"232218966429843369729092732722083348927",
"23804693792155640436994265998586518637",
"332572749335404922897488099069078647769"
]
},
"target": {
"file": "drivers/net/team/team.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7fb47b9711101d2405b0eb1276fb1f9b9b270c7",
"id": "CVE-2023-52574-9a2bb8f1",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "21587549419069229727376995021793684392",
"length": 908.0
},
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f0acb0736ecc3eb85dc80ad2790d634dcb10b58",
"id": "CVE-2023-52574-9e6810a5",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "21587549419069229727376995021793684392",
"length": 908.0
},
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cac50d9f5d876be32cb9aa21c74018468900284d",
"id": "CVE-2023-52574-bfc92886",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"58466714574711081973871212898881575716",
"14081376067144396504301549215720115235",
"317729735304802125846673714205658180328",
"25921442780430946876446846096494132965",
"157374768807426339696960807617585494947",
"131434261467451809041628166815452332574",
"321766604170215602577270242947670338919",
"232218966429843369729092732722083348927",
"23804693792155640436994265998586518637",
"332572749335404922897488099069078647769"
]
},
"target": {
"file": "drivers/net/team/team.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f0acb0736ecc3eb85dc80ad2790d634dcb10b58",
"id": "CVE-2023-52574-d3892152",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "10814261026284728307388336407618140569",
"length": 785.0
},
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup_by_port"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd05eec2ee0cc396813a32ef675634e403748255",
"id": "CVE-2023-52574-d55bcc70",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"58466714574711081973871212898881575716",
"14081376067144396504301549215720115235",
"317729735304802125846673714205658180328",
"25921442780430946876446846096494132965",
"157374768807426339696960807617585494947",
"131434261467451809041628166815452332574",
"321766604170215602577270242947670338919",
"232218966429843369729092732722083348927",
"23804693792155640436994265998586518637",
"332572749335404922897488099069078647769"
]
},
"target": {
"file": "drivers/net/team/team.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cac50d9f5d876be32cb9aa21c74018468900284d",
"id": "CVE-2023-52574-d78b0c5e",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "10814261026284728307388336407618140569",
"length": 785.0
},
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup_by_port"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b44dd92e2afd89eb6e9d27616858e72a67bdc1a7",
"id": "CVE-2023-52574-ddc48616",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "55732945693060538177700984865358513597",
"length": 929.0
},
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b44dd92e2afd89eb6e9d27616858e72a67bdc1a7",
"id": "CVE-2023-52574-de3c6d4b",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "10814261026284728307388336407618140569",
"length": 785.0
},
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup_by_port"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cac50d9f5d876be32cb9aa21c74018468900284d",
"id": "CVE-2023-52574-e71e3ce1",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "55732945693060538177700984865358513597",
"length": 929.0
},
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7fb47b9711101d2405b0eb1276fb1f9b9b270c7",
"id": "CVE-2023-52574-eb9512e7",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260689445606164492464611624250147724855",
"283233440538128571245282378544239102934",
"132673494665694999360453569736095819998"
]
},
"target": {
"file": "include/linux/if_team.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd05eec2ee0cc396813a32ef675634e403748255",
"id": "CVE-2023-52574-f2c874dc",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "10814261026284728307388336407618140569",
"length": 785.0
},
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup_by_port"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@492032760127251e5540a5716a70996bacf2a3fd",
"id": "CVE-2023-52574-f6046af9",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "10814261026284728307388336407618140569",
"length": 785.0
},
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup_by_port"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7fb47b9711101d2405b0eb1276fb1f9b9b270c7",
"id": "CVE-2023-52574-f60ee8d9",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260689445606164492464611624250147724855",
"283233440538128571245282378544239102934",
"132673494665694999360453569736095819998"
]
},
"target": {
"file": "include/linux/if_team.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cac50d9f5d876be32cb9aa21c74018468900284d",
"id": "CVE-2023-52574-fb84a1a7",
"deprecated": false,
"signature_version": "v1"
}
]