In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: fix flow memory leak in ovsflowcmd_new
Syzkaller reports a memory leak of newflow in ovsflowcmdnew() as it is not freed when an allocation of a key fails.
BUG: memory leak unreferenced object 0xffff888116668000 (size 632): comm "syz-executor231", pid 1090, jiffies 4294844701 (age 18.871s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000defa3494>] kmemcachezalloc include/linux/slab.h:654 [inline] [<00000000defa3494>] ovsflowalloc+0x19/0x180 net/openvswitch/flowtable.c:77 [<00000000c67d8873>] ovsflowcmdnew+0x1de/0xd40 net/openvswitch/datapath.c:957 [<0000000010a539a8>] genlfamilyrcvmsgdoit+0x22d/0x330 net/netlink/genetlink.c:739 [<00000000dff3302d>] genlfamilyrcvmsg net/netlink/genetlink.c:783 [inline] [<00000000dff3302d>] genlrcvmsg+0x328/0x590 net/netlink/genetlink.c:800 [<000000000286dd87>] netlinkrcvskb+0x153/0x430 net/netlink/afnetlink.c:2515 [<0000000061fed410>] genlrcv+0x24/0x40 net/netlink/genetlink.c:811 [<000000009dc0f111>] netlinkunicastkernel net/netlink/afnetlink.c:1313 [inline] [<000000009dc0f111>] netlinkunicast+0x545/0x7f0 net/netlink/afnetlink.c:1339 [<000000004a5ee816>] netlinksendmsg+0x8e7/0xde0 net/netlink/afnetlink.c:1934 [<00000000482b476f>] socksendmsgnosec net/socket.c:651 [inline] [<00000000482b476f>] socksendmsg+0x152/0x190 net/socket.c:671 [<00000000698574ba>] syssendmsg+0x70a/0x870 net/socket.c:2356 [<00000000d28d9e11>] syssendmsg+0xf3/0x170 net/socket.c:2410 [<0000000083ba9120>] _syssendmsg+0xe5/0x1b0 net/socket.c:2439 [<00000000c00628f8>] dosyscall64+0x30/0x40 arch/x86/entry/common.c:46 [<000000004abfdcf4>] entrySYSCALL64afterhwframe+0x61/0xc6
To fix this the patch rearranges the goto labels to reflect the order of object allocations and adds appropriate goto statements on the error paths.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed6c5e8caf55778500202775167e8ccdb1a030cb",
"digest": {
"function_hash": "174711030867058844966700038051131031096",
"length": 3058.0
},
"target": {
"function": "ovs_flow_cmd_new",
"file": "net/openvswitch/datapath.c"
},
"id": "CVE-2023-52977-244bc50f",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c598aed445eb45b0ee7ba405f7ece99ee349c30",
"digest": {
"threshold": 0.9,
"line_hashes": [
"151206510761422222701791920478147484343",
"121854541004321995097693938831626834047",
"213292955333364179448599603076451631268",
"24327933494313157684354324639053586177",
"91107385549185403274280073741404597507",
"144761229793604285088154618563196759868",
"19020426694440359876322741666241901164",
"73297652780143361764611369163479375653",
"10651864620613257739659710764847979897",
"199966379363212695184322436440296792629",
"30681176914067243414097680709953833293",
"142603058139384402715386242645554627765",
"187064800623498045495110617761998759297",
"48595057740667348748212588422797441003",
"15170300437503455869782491374111916309",
"225337254800287150897532311021351126470",
"196682338440059409263020326255840218487",
"46038038853656759696757407663900237359",
"279761124727803712979458313024599247919",
"291655113351933060893819331345481693009",
"66096053625296122963385632508814488797",
"140949723520487330339907230083479718797",
"308225610858244431878599042803199130054",
"138447658238594080828032138784466800070",
"220122579830239737624723598339018289321",
"330907050335377116731814947506076249719"
]
},
"target": {
"file": "net/openvswitch/datapath.c"
},
"id": "CVE-2023-52977-29955221",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af4e720bc00a2653f7b9df21755b9978b3d7f386",
"digest": {
"function_hash": "174711030867058844966700038051131031096",
"length": 3058.0
},
"target": {
"function": "ovs_flow_cmd_new",
"file": "net/openvswitch/datapath.c"
},
"id": "CVE-2023-52977-2b05458c",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ac653cf886cdfc082708c82dc6ac6115cebd2ee",
"digest": {
"function_hash": "174711030867058844966700038051131031096",
"length": 3058.0
},
"target": {
"function": "ovs_flow_cmd_new",
"file": "net/openvswitch/datapath.c"
},
"id": "CVE-2023-52977-3494ae20",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70154489f531587996f3e9d7cceeee65cff0001d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"151206510761422222701791920478147484343",
"121854541004321995097693938831626834047",
"213292955333364179448599603076451631268",
"24327933494313157684354324639053586177",
"91107385549185403274280073741404597507",
"144761229793604285088154618563196759868",
"19020426694440359876322741666241901164",
"73297652780143361764611369163479375653",
"10651864620613257739659710764847979897",
"199966379363212695184322436440296792629",
"30681176914067243414097680709953833293",
"142603058139384402715386242645554627765",
"187064800623498045495110617761998759297",
"48595057740667348748212588422797441003",
"15170300437503455869782491374111916309",
"225337254800287150897532311021351126470",
"196682338440059409263020326255840218487",
"46038038853656759696757407663900237359",
"279761124727803712979458313024599247919",
"291655113351933060893819331345481693009",
"66096053625296122963385632508814488797",
"140949723520487330339907230083479718797",
"308225610858244431878599042803199130054",
"138447658238594080828032138784466800070",
"220122579830239737624723598339018289321",
"330907050335377116731814947506076249719"
]
},
"target": {
"file": "net/openvswitch/datapath.c"
},
"id": "CVE-2023-52977-42372d03",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70154489f531587996f3e9d7cceeee65cff0001d",
"digest": {
"function_hash": "174711030867058844966700038051131031096",
"length": 3058.0
},
"target": {
"function": "ovs_flow_cmd_new",
"file": "net/openvswitch/datapath.c"
},
"id": "CVE-2023-52977-47922b83",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed6c5e8caf55778500202775167e8ccdb1a030cb",
"digest": {
"threshold": 0.9,
"line_hashes": [
"151206510761422222701791920478147484343",
"121854541004321995097693938831626834047",
"213292955333364179448599603076451631268",
"24327933494313157684354324639053586177",
"91107385549185403274280073741404597507",
"144761229793604285088154618563196759868",
"19020426694440359876322741666241901164",
"73297652780143361764611369163479375653",
"10651864620613257739659710764847979897",
"199966379363212695184322436440296792629",
"30681176914067243414097680709953833293",
"142603058139384402715386242645554627765",
"187064800623498045495110617761998759297",
"48595057740667348748212588422797441003",
"15170300437503455869782491374111916309",
"225337254800287150897532311021351126470",
"196682338440059409263020326255840218487",
"46038038853656759696757407663900237359",
"279761124727803712979458313024599247919",
"291655113351933060893819331345481693009",
"66096053625296122963385632508814488797",
"140949723520487330339907230083479718797",
"308225610858244431878599042803199130054",
"138447658238594080828032138784466800070",
"220122579830239737624723598339018289321",
"330907050335377116731814947506076249719"
]
},
"target": {
"file": "net/openvswitch/datapath.c"
},
"id": "CVE-2023-52977-6ba4008c",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af4e720bc00a2653f7b9df21755b9978b3d7f386",
"digest": {
"threshold": 0.9,
"line_hashes": [
"151206510761422222701791920478147484343",
"121854541004321995097693938831626834047",
"213292955333364179448599603076451631268",
"24327933494313157684354324639053586177",
"91107385549185403274280073741404597507",
"144761229793604285088154618563196759868",
"19020426694440359876322741666241901164",
"73297652780143361764611369163479375653",
"10651864620613257739659710764847979897",
"199966379363212695184322436440296792629",
"30681176914067243414097680709953833293",
"142603058139384402715386242645554627765",
"187064800623498045495110617761998759297",
"48595057740667348748212588422797441003",
"15170300437503455869782491374111916309",
"225337254800287150897532311021351126470",
"196682338440059409263020326255840218487",
"46038038853656759696757407663900237359",
"279761124727803712979458313024599247919",
"291655113351933060893819331345481693009",
"66096053625296122963385632508814488797",
"140949723520487330339907230083479718797",
"308225610858244431878599042803199130054",
"138447658238594080828032138784466800070",
"220122579830239737624723598339018289321",
"330907050335377116731814947506076249719"
]
},
"target": {
"file": "net/openvswitch/datapath.c"
},
"id": "CVE-2023-52977-6da60829",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f423c2efd51d7eb1d143c2be7eea233241d9bbbf",
"digest": {
"threshold": 0.9,
"line_hashes": [
"151206510761422222701791920478147484343",
"121854541004321995097693938831626834047",
"213292955333364179448599603076451631268",
"24327933494313157684354324639053586177",
"91107385549185403274280073741404597507",
"144761229793604285088154618563196759868",
"19020426694440359876322741666241901164",
"73297652780143361764611369163479375653",
"10651864620613257739659710764847979897",
"199966379363212695184322436440296792629",
"30681176914067243414097680709953833293",
"142603058139384402715386242645554627765",
"187064800623498045495110617761998759297",
"48595057740667348748212588422797441003",
"15170300437503455869782491374111916309",
"225337254800287150897532311021351126470",
"196682338440059409263020326255840218487",
"46038038853656759696757407663900237359",
"279761124727803712979458313024599247919",
"291655113351933060893819331345481693009",
"66096053625296122963385632508814488797",
"140949723520487330339907230083479718797",
"308225610858244431878599042803199130054",
"138447658238594080828032138784466800070",
"220122579830239737624723598339018289321",
"330907050335377116731814947506076249719"
]
},
"target": {
"file": "net/openvswitch/datapath.c"
},
"id": "CVE-2023-52977-72f8d072",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f423c2efd51d7eb1d143c2be7eea233241d9bbbf",
"digest": {
"function_hash": "174711030867058844966700038051131031096",
"length": 3058.0
},
"target": {
"function": "ovs_flow_cmd_new",
"file": "net/openvswitch/datapath.c"
},
"id": "CVE-2023-52977-91dcc189",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70d40674a549d498bd63d5432acf46205da1534b",
"digest": {
"function_hash": "174711030867058844966700038051131031096",
"length": 3058.0
},
"target": {
"function": "ovs_flow_cmd_new",
"file": "net/openvswitch/datapath.c"
},
"id": "CVE-2023-52977-98006f17",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70d40674a549d498bd63d5432acf46205da1534b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"151206510761422222701791920478147484343",
"121854541004321995097693938831626834047",
"213292955333364179448599603076451631268",
"24327933494313157684354324639053586177",
"91107385549185403274280073741404597507",
"144761229793604285088154618563196759868",
"19020426694440359876322741666241901164",
"73297652780143361764611369163479375653",
"10651864620613257739659710764847979897",
"199966379363212695184322436440296792629",
"30681176914067243414097680709953833293",
"142603058139384402715386242645554627765",
"187064800623498045495110617761998759297",
"48595057740667348748212588422797441003",
"15170300437503455869782491374111916309",
"225337254800287150897532311021351126470",
"196682338440059409263020326255840218487",
"46038038853656759696757407663900237359",
"279761124727803712979458313024599247919",
"291655113351933060893819331345481693009",
"66096053625296122963385632508814488797",
"140949723520487330339907230083479718797",
"308225610858244431878599042803199130054",
"138447658238594080828032138784466800070",
"220122579830239737624723598339018289321",
"330907050335377116731814947506076249719"
]
},
"target": {
"file": "net/openvswitch/datapath.c"
},
"id": "CVE-2023-52977-bd74555c",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c598aed445eb45b0ee7ba405f7ece99ee349c30",
"digest": {
"function_hash": "174711030867058844966700038051131031096",
"length": 3058.0
},
"target": {
"function": "ovs_flow_cmd_new",
"file": "net/openvswitch/datapath.c"
},
"id": "CVE-2023-52977-c5fd9513",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ac653cf886cdfc082708c82dc6ac6115cebd2ee",
"digest": {
"threshold": 0.9,
"line_hashes": [
"151206510761422222701791920478147484343",
"121854541004321995097693938831626834047",
"213292955333364179448599603076451631268",
"24327933494313157684354324639053586177",
"91107385549185403274280073741404597507",
"144761229793604285088154618563196759868",
"19020426694440359876322741666241901164",
"73297652780143361764611369163479375653",
"10651864620613257739659710764847979897",
"199966379363212695184322436440296792629",
"30681176914067243414097680709953833293",
"142603058139384402715386242645554627765",
"187064800623498045495110617761998759297",
"48595057740667348748212588422797441003",
"15170300437503455869782491374111916309",
"225337254800287150897532311021351126470",
"196682338440059409263020326255840218487",
"46038038853656759696757407663900237359",
"279761124727803712979458313024599247919",
"291655113351933060893819331345481693009",
"66096053625296122963385632508814488797",
"140949723520487330339907230083479718797",
"308225610858244431878599042803199130054",
"138447658238594080828032138784466800070",
"220122579830239737624723598339018289321",
"330907050335377116731814947506076249719"
]
},
"target": {
"file": "net/openvswitch/datapath.c"
},
"id": "CVE-2023-52977-e5375abb",
"signature_version": "v1",
"signature_type": "Line"
}
]