In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrumacltcam: Fix NULL pointer dereference in error path
When calling mlxswspacltcamregion_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1].
Fix by retrieving the 'tcam' pointer using mlxswspacltotcam().
[1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxswspacltcamregiondestroy+0xa0/0xd0 [...] Call Trace: mlxswspacltcamvchunkget+0x88b/0xa20 mlxswspacltcamventryadd+0x25/0xe0 mlxswspaclruleadd+0x47/0x240 mlxswspflowerreplace+0x1a9/0x1d0 tcsetupcbadd+0xdc/0x1c0 flhwreplacefilter+0x146/0x1f0 flchange+0xc17/0x1360 tcnewtfilter+0x472/0xb90 rtnetlinkrcvmsg+0x313/0x3b0 netlinkrcvskb+0x58/0x100 netlinkunicast+0x244/0x390 netlinksendmsg+0x1e4/0x440 syssendmsg+0x164/0x260 syssendmsg+0x9a/0xe0 _syssendmsg+0x7a/0xc0 dosyscall64+0x40/0xe0 entrySYSCALL64afterhwframe+0x63/0x6b
{ "vanir_signatures": [ { "signature_version": "v1", "target": { "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum.h" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75fa2d8b3c0175b519c99ace54ab8474cfd0077e", "deprecated": false, "digest": { "line_hashes": [ "73030607510533627832011332862344741052", "561347873187563776334314644747156833", "295652865675934210157120430486304905844", "274446985287388463415858319007029374768" ], "threshold": 0.9 }, "id": "CVE-2024-26595-0457194d" }, { "signature_version": "v1", "target": { "function": "mlxsw_sp_acl_tcam_region_destroy", "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@817840d125a370626895df269c50c923b79b0a39", "deprecated": false, "digest": { "length": 281.0, "function_hash": "104097629979135092274317188317871538573" }, "id": "CVE-2024-26595-0862e49f" }, { "signature_version": "v1", "target": { "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75fa2d8b3c0175b519c99ace54ab8474cfd0077e", "deprecated": false, "digest": { "line_hashes": [ "948282901695979400109057717598778433", "2176816689356933138583178309976026593", "205949498010248468255645142528668180345", "75088672559733697563139860707780620118", "100230548128459456994477374670658440296", "285178938922680014862994306082384521340", "56892082230934400500719868511438764683", "172917209542558552141520346525876674079", "15552772683463728382351677523525868605", "68914525265303577504020206844060142457" ], "threshold": 0.9 }, "id": "CVE-2024-26595-2caaf4e0" }, { "signature_version": "v1", "target": { "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@817840d125a370626895df269c50c923b79b0a39", "deprecated": false, "digest": { "line_hashes": [ "948282901695979400109057717598778433", "2176816689356933138583178309976026593", "205949498010248468255645142528668180345", "75088672559733697563139860707780620118", "100230548128459456994477374670658440296", "285178938922680014862994306082384521340", "56892082230934400500719868511438764683", "172917209542558552141520346525876674079", "15552772683463728382351677523525868605", "68914525265303577504020206844060142457" ], "threshold": 0.9 }, "id": "CVE-2024-26595-5c9851d2" }, { "signature_version": "v1", "target": { "function": "mlxsw_sp_acl_tcam_region_destroy", "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75fa2d8b3c0175b519c99ace54ab8474cfd0077e", "deprecated": false, "digest": { "length": 281.0, "function_hash": "104097629979135092274317188317871538573" }, "id": "CVE-2024-26595-894f8042" }, { "signature_version": "v1", "target": { "function": "mlxsw_sp_acl_tcam_region_destroy", "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efeb7dfea8ee10cdec11b6b6ba4e405edbe75809", "deprecated": false, "digest": { "length": 281.0, "function_hash": "104097629979135092274317188317871538573" }, "id": "CVE-2024-26595-9a00bf99" }, { "signature_version": "v1", "target": { "function": "mlxsw_sp_acl_tcam_region_destroy", "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0a1efe417c97a1e9b914056ee6b86f1ef75fe1f", "deprecated": false, "digest": { "length": 281.0, "function_hash": "104097629979135092274317188317871538573" }, "id": "CVE-2024-26595-bcb70efb" }, { "signature_version": "v1", "target": { "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0a1efe417c97a1e9b914056ee6b86f1ef75fe1f", "deprecated": false, "digest": { "line_hashes": [ "948282901695979400109057717598778433", "2176816689356933138583178309976026593", "205949498010248468255645142528668180345", "75088672559733697563139860707780620118", "100230548128459456994477374670658440296", "285178938922680014862994306082384521340", "56892082230934400500719868511438764683", "172917209542558552141520346525876674079", "15552772683463728382351677523525868605", "68914525265303577504020206844060142457" ], "threshold": 0.9 }, "id": "CVE-2024-26595-c88f1e2f" }, { "signature_version": "v1", "target": { "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efeb7dfea8ee10cdec11b6b6ba4e405edbe75809", "deprecated": false, "digest": { "line_hashes": [ "948282901695979400109057717598778433", "2176816689356933138583178309976026593", "205949498010248468255645142528668180345", "75088672559733697563139860707780620118", "100230548128459456994477374670658440296", "285178938922680014862994306082384521340", "56892082230934400500719868511438764683", "172917209542558552141520346525876674079", "15552772683463728382351677523525868605", "68914525265303577504020206844060142457" ], "threshold": 0.9 }, "id": "CVE-2024-26595-ee98ab6e" }, { "signature_version": "v1", "target": { "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75fa2d8b3c0175b519c99ace54ab8474cfd0077e", "deprecated": false, "digest": { "line_hashes": [ "135224182301081910984716441803622914867", "175787057062364719359077843770912552093", "159381257994850634692892687644835437246" ], "threshold": 0.9 }, "id": "CVE-2024-26595-f4c9ede0" } ] }