DEBIAN-CVE-2024-42073

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2024-42073
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-42073.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2024-42073
Upstream
Published
2024-07-29T16:15:06Z
Modified
2025-09-30T05:19:24.106623Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumbuffers: Fix memory corruptions on Spectrum-4 systems The following two shared buffer operations make use of the Shared Buffer Status Register (SBSR): # devlink sb occupancy snapshot pci/0000:01:00.0 # devlink sb occupancy clearmax pci/0000:01:00.0 The register has two masks of 256 bits to denote on which ingress / egress ports the register should operate on. Spectrum-4 has more than 256 ports, so the register was extended by cited commit with a new 'portpage' field. However, when filling the register's payload, the driver specifies the ports as absolute numbers and not relative to the first port of the port page, resulting in memory corruptions [1]. Fix by specifying the ports relative to the first port of the port page. [1] BUG: KASAN: slab-use-after-free in mlxswspsboccsnapshot+0xb6d/0xbc0 Read of size 1 at addr ffff8881068cb00f by task devlink/1566 [...] Call Trace: <TASK> dumpstacklvl+0xc6/0x120 printreport+0xce/0x670 kasanreport+0xd7/0x110 mlxswspsboccsnapshot+0xb6d/0xbc0 mlxswdevlinksboccsnapshot+0x75/0xb0 devlinknlsboccsnapshotdoit+0x1f9/0x2a0 genlfamilyrcvmsgdoit+0x20c/0x300 genlrcvmsg+0x567/0x800 netlinkrcvskb+0x170/0x450 genlrcv+0x2d/0x40 netlinkunicast+0x547/0x830 netlinksendmsg+0x8d4/0xdb0 _syssendto+0x49b/0x510 _x64syssendto+0xe5/0x1c0 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f [...] Allocated by task 1: kasansavestack+0x33/0x60 kasansavetrack+0x14/0x30 _kasankmalloc+0x8f/0xa0 copyverifierstate+0xbc2/0xfb0 docheckcommon+0x2c51/0xc7e0 bpfcheck+0x5107/0x9960 bpfprogload+0xf0e/0x2690 _sysbpf+0x1a61/0x49d0 _x64sysbpf+0x7d/0xc0 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f Freed by task 1: kasansavestack+0x33/0x60 kasansavetrack+0x14/0x30 kasansavefreeinfo+0x3b/0x60 poisonslabobject+0x109/0x170 _kasanslabfree+0x14/0x30 kfree+0xca/0x2b0 freeverifierstate+0xce/0x270 docheckcommon+0x4828/0xc7e0 bpfcheck+0x5107/0x9960 bpfprogload+0xf0e/0x2690 _sysbpf+0x1a61/0x49d0 _x64sysbpf+0x7d/0xc0 dosyscall64+0xc1/0x1d0 entrySYSCALL64after_hwframe+0x77/0x7f

References

Affected packages

Debian:12 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.98-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.9.8-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.9.8-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:11 / linux-6.1

Package

Name
linux-6.1
Purl
pkg:deb/debian/linux-6.1?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.119-1~deb11u1

Affected versions

6.*

6.1.106-3~deb11u1
6.1.106-3~deb11u2
6.1.106-3~deb11u3
6.1.112-1~deb11u1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}