In the Linux kernel, the following vulnerability has been resolved:
team: fix null-ptr-deref when team device type is changed
Get a null-ptr-deref bug as follows with reproducer [1].
BUG: kernel NULL pointer dereference, address: 0000000000000228 ... RIP: 0010:vlandevhardheader+0x35/0x140 [8021q] ... Call Trace: <TASK> ? _die+0x24/0x70 ? pagefaultoops+0x82/0x150 ? excpagefault+0x69/0x150 ? asmexcpagefault+0x26/0x30 ? vlandevhardheader+0x35/0x140 [8021q] ? vlandevhardheader+0x8e/0x140 [8021q] neighconnectedoutput+0xb2/0x100 ip6finishoutput2+0x1cb/0x520 ? nfhookslow+0x43/0xc0 ? ip6mtu+0x46/0x80 ip6finishoutput+0x2a/0xb0 mldsendpack+0x18f/0x250 mldifcwork+0x39/0x160 processonework+0x1e6/0x3f0 workerthread+0x4d/0x2f0 ? _pfxworkerthread+0x10/0x10 kthread+0xe5/0x120 ? _pfxkthread+0x10/0x10 retfromfork+0x34/0x50 ? _pfxkthread+0x10/0x10 retfromforkasm+0x1b/0x30
[1] $ teamd -t team0 -d -c '{"runner": {"name": "loadbalance"}}' $ ip link add name t-dummy type dummy $ ip link add link t-dummy name t-dummy.100 type vlan id 100 $ ip link add name t-nlmon type nlmon $ ip link set t-nlmon master team0 $ ip link set t-nlmon nomaster $ ip link set t-dummy up $ ip link set team0 up $ ip link set t-dummy.100 down $ ip link set t-dummy.100 master team0
When enslave a vlan device to team device and team device type is changed from non-ether to ether, headerops of team device is changed to vlanheaderops. That is incorrect and will trigger null-ptr-deref for vlan->realdev in vlandevhard_header() because team device is not a vlan device.
Cache ethheaderops in teamsetup(), then assign cached headerops to header_ops of team net device when its type is changed from non-ether to ether to fix the bug.
[
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 908.0,
"function_hash": "21587549419069229727376995021793684392"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cac50d9f5d876be32cb9aa21c74018468900284d",
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup"
},
"id": "CVE-2023-52574-bfc92886"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"58466714574711081973871212898881575716",
"14081376067144396504301549215720115235",
"317729735304802125846673714205658180328",
"25921442780430946876446846096494132965",
"157374768807426339696960807617585494947",
"131434261467451809041628166815452332574",
"321766604170215602577270242947670338919",
"232218966429843369729092732722083348927",
"23804693792155640436994265998586518637",
"332572749335404922897488099069078647769"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cac50d9f5d876be32cb9aa21c74018468900284d",
"target": {
"file": "drivers/net/team/team.c"
},
"id": "CVE-2023-52574-d78b0c5e"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 785.0,
"function_hash": "10814261026284728307388336407618140569"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cac50d9f5d876be32cb9aa21c74018468900284d",
"target": {
"file": "drivers/net/team/team.c",
"function": "team_setup_by_port"
},
"id": "CVE-2023-52574-e71e3ce1"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"260689445606164492464611624250147724855",
"283233440538128571245282378544239102934",
"132673494665694999360453569736095819998"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cac50d9f5d876be32cb9aa21c74018468900284d",
"target": {
"file": "include/linux/if_team.h"
},
"id": "CVE-2023-52574-fb84a1a7"
}
]