CVE-2023-52574

Source
https://nvd.nist.gov/vuln/detail/CVE-2023-52574
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52574.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-52574
Downstream
Related
Published
2024-03-02T22:15:49Z
Modified
2025-08-09T19:01:26Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

team: fix null-ptr-deref when team device type is changed

Get a null-ptr-deref bug as follows with reproducer [1].

BUG: kernel NULL pointer dereference, address: 0000000000000228 ... RIP: 0010:vlandevhardheader+0x35/0x140 [8021q] ... Call Trace: <TASK> ? _die+0x24/0x70 ? pagefaultoops+0x82/0x150 ? excpagefault+0x69/0x150 ? asmexcpagefault+0x26/0x30 ? vlandevhardheader+0x35/0x140 [8021q] ? vlandevhardheader+0x8e/0x140 [8021q] neighconnectedoutput+0xb2/0x100 ip6finishoutput2+0x1cb/0x520 ? nfhookslow+0x43/0xc0 ? ip6mtu+0x46/0x80 ip6finishoutput+0x2a/0xb0 mldsendpack+0x18f/0x250 mldifcwork+0x39/0x160 processonework+0x1e6/0x3f0 workerthread+0x4d/0x2f0 ? _pfxworkerthread+0x10/0x10 kthread+0xe5/0x120 ? _pfxkthread+0x10/0x10 retfromfork+0x34/0x50 ? _pfxkthread+0x10/0x10 retfromforkasm+0x1b/0x30

[1] $ teamd -t team0 -d -c '{"runner": {"name": "loadbalance"}}' $ ip link add name t-dummy type dummy $ ip link add link t-dummy name t-dummy.100 type vlan id 100 $ ip link add name t-nlmon type nlmon $ ip link set t-nlmon master team0 $ ip link set t-nlmon nomaster $ ip link set t-dummy up $ ip link set team0 up $ ip link set t-dummy.100 down $ ip link set t-dummy.100 master team0

When enslave a vlan device to team device and team device type is changed from non-ether to ether, headerops of team device is changed to vlanheaderops. That is incorrect and will trigger null-ptr-deref for vlan->realdev in vlandevhard_header() because team device is not a vlan device.

Cache ethheaderops in teamsetup(), then assign cached headerops to header_ops of team net device when its type is changed from non-ether to ether to fix the bug.

References

Affected packages