In the Linux kernel, the following vulnerability has been resolved:
aoe: fix the potential use-after-free problem in aoecmdcfgpkts
This patch is against CVE-2023-6270. The description of cve is:
A flaw was found in the ATA over Ethernet (AoE) driver in the Linux
kernel. The aoecmdcfgpkts() function improperly updates the refcnt on
struct net_device, and a use-after-free can be triggered by racing
between the free on the struct and the access through the skbtxq
global queue. This could lead to a denial of service condition or
potential code execution.
In aoecmdcfgpkts(), it always calls devput(ifp) when skb initial code is finished. But the netdevice ifp will still be used in later tx()->devqueuexmit() in kthread. Which means that the devput(ifp) should NOT be called in the success path of skb initial code in aoecmdcfgpkts(). Otherwise tx() may run into use-after-free because the netdevice is freed.
This patch removed the devput(ifp) in the success path in aoecmdcfgpkts(), and added devput() after skb xmit in tx().
[
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"85210291630426069408951846321744776433",
"264747940576684411359305945148059936423",
"62524154778006105861895376088465866998",
"252883027800611591859965089465172670869",
"114562215982176959153086612512670556948",
"249699421251338742574325815976325328750",
"224206609596530917752165676891975851867",
"137399159462771368226355848333582160214",
"9793551507984638256857109342569905884",
"274972991736046551567317558626758665785",
"94527920358426669624816244971037927115",
"143499658950008116818724723959692753564",
"268930247368345359176020550749204088790",
"207113936013465686054479221707243285986"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/aoe/aoecmd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb48680b0255a9e8a9bdc93d6a55b11c31262e62",
"signature_version": "v1",
"id": "CVE-2024-26898-0e8e6950"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"223911977273194985193212596155992525242",
"56555484437891917397010791246576319968",
"223756486538519069238593916984309787698",
"95523807756613101201097730465542172064"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/aoe/aoenet.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@faf0b4c5e00bb680e8e43ac936df24d3f48c8e65",
"signature_version": "v1",
"id": "CVE-2024-26898-16030bdf"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 880.0,
"function_hash": "74588214940311563015393913723536165040"
},
"target": {
"file": "drivers/block/aoe/aoecmd.c",
"function": "aoecmd_cfg_pkts"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f98364e926626c678fb4b9004b75cacf92ff0662",
"signature_version": "v1",
"id": "CVE-2024-26898-188ecf3e"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"223911977273194985193212596155992525242",
"56555484437891917397010791246576319968",
"223756486538519069238593916984309787698",
"95523807756613101201097730465542172064"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/aoe/aoenet.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb48680b0255a9e8a9bdc93d6a55b11c31262e62",
"signature_version": "v1",
"id": "CVE-2024-26898-1d3dff32"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 880.0,
"function_hash": "74588214940311563015393913723536165040"
},
"target": {
"file": "drivers/block/aoe/aoecmd.c",
"function": "aoecmd_cfg_pkts"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb48680b0255a9e8a9bdc93d6a55b11c31262e62",
"signature_version": "v1",
"id": "CVE-2024-26898-414bda46"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 880.0,
"function_hash": "74588214940311563015393913723536165040"
},
"target": {
"file": "drivers/block/aoe/aoecmd.c",
"function": "aoecmd_cfg_pkts"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@faf0b4c5e00bb680e8e43ac936df24d3f48c8e65",
"signature_version": "v1",
"id": "CVE-2024-26898-46529f8c"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"223911977273194985193212596155992525242",
"56555484437891917397010791246576319968",
"223756486538519069238593916984309787698",
"95523807756613101201097730465542172064"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/aoe/aoenet.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a16fbb80064634b254520a46395e36b87ca4731e",
"signature_version": "v1",
"id": "CVE-2024-26898-65b8760a"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 880.0,
"function_hash": "74588214940311563015393913723536165040"
},
"target": {
"file": "drivers/block/aoe/aoecmd.c",
"function": "aoecmd_cfg_pkts"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a16fbb80064634b254520a46395e36b87ca4731e",
"signature_version": "v1",
"id": "CVE-2024-26898-72c39e72"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"223911977273194985193212596155992525242",
"56555484437891917397010791246576319968",
"223756486538519069238593916984309787698",
"95523807756613101201097730465542172064"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/aoe/aoenet.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad80c34944d7175fa1f5c7a55066020002921a99",
"signature_version": "v1",
"id": "CVE-2024-26898-75c5ced3"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 880.0,
"function_hash": "74588214940311563015393913723536165040"
},
"target": {
"file": "drivers/block/aoe/aoecmd.c",
"function": "aoecmd_cfg_pkts"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad80c34944d7175fa1f5c7a55066020002921a99",
"signature_version": "v1",
"id": "CVE-2024-26898-89033951"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"85210291630426069408951846321744776433",
"264747940576684411359305945148059936423",
"62524154778006105861895376088465866998",
"252883027800611591859965089465172670869",
"114562215982176959153086612512670556948",
"249699421251338742574325815976325328750",
"224206609596530917752165676891975851867",
"137399159462771368226355848333582160214",
"9793551507984638256857109342569905884",
"274972991736046551567317558626758665785",
"94527920358426669624816244971037927115",
"143499658950008116818724723959692753564",
"268930247368345359176020550749204088790",
"207113936013465686054479221707243285986"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/aoe/aoecmd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@faf0b4c5e00bb680e8e43ac936df24d3f48c8e65",
"signature_version": "v1",
"id": "CVE-2024-26898-93767cf3"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"85210291630426069408951846321744776433",
"264747940576684411359305945148059936423",
"62524154778006105861895376088465866998",
"252883027800611591859965089465172670869",
"114562215982176959153086612512670556948",
"249699421251338742574325815976325328750",
"224206609596530917752165676891975851867",
"137399159462771368226355848333582160214",
"9793551507984638256857109342569905884",
"274972991736046551567317558626758665785",
"94527920358426669624816244971037927115",
"143499658950008116818724723959692753564",
"268930247368345359176020550749204088790",
"207113936013465686054479221707243285986"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/aoe/aoecmd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f98364e926626c678fb4b9004b75cacf92ff0662",
"signature_version": "v1",
"id": "CVE-2024-26898-a31a0226"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"85210291630426069408951846321744776433",
"264747940576684411359305945148059936423",
"62524154778006105861895376088465866998",
"252883027800611591859965089465172670869",
"114562215982176959153086612512670556948",
"249699421251338742574325815976325328750",
"224206609596530917752165676891975851867",
"137399159462771368226355848333582160214",
"9793551507984638256857109342569905884",
"274972991736046551567317558626758665785",
"94527920358426669624816244971037927115",
"143499658950008116818724723959692753564",
"268930247368345359176020550749204088790",
"207113936013465686054479221707243285986"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/aoe/aoecmd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad80c34944d7175fa1f5c7a55066020002921a99",
"signature_version": "v1",
"id": "CVE-2024-26898-b3a8a370"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"223911977273194985193212596155992525242",
"56555484437891917397010791246576319968",
"223756486538519069238593916984309787698",
"95523807756613101201097730465542172064"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/aoe/aoenet.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f98364e926626c678fb4b9004b75cacf92ff0662",
"signature_version": "v1",
"id": "CVE-2024-26898-b423fb54"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"85210291630426069408951846321744776433",
"264747940576684411359305945148059936423",
"62524154778006105861895376088465866998",
"252883027800611591859965089465172670869",
"114562215982176959153086612512670556948",
"249699421251338742574325815976325328750",
"224206609596530917752165676891975851867",
"137399159462771368226355848333582160214",
"9793551507984638256857109342569905884",
"274972991736046551567317558626758665785",
"94527920358426669624816244971037927115",
"143499658950008116818724723959692753564",
"268930247368345359176020550749204088790",
"207113936013465686054479221707243285986"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/aoe/aoecmd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a16fbb80064634b254520a46395e36b87ca4731e",
"signature_version": "v1",
"id": "CVE-2024-26898-d9b1d82e"
}
]