CVE-2024-26681
Vulnerability from cvelistv5
Published
2024-04-02 07:01
Modified
2024-09-11 17:33
Severity ?
EPSS score ?
Summary
netdevsim: avoid potential loop in nsim_dev_trap_report_work()
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:14:12.959Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/0193e0660cc6689c794794b471492923cfd7bfbc"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/6eecddd9c3c8d6e3a097531cdc6d500335b35e46"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/d91964cdada76740811b7c621239f9c407820dbc"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/ba5e1272142d051dcc57ca1d3225ad8a089f9858"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-26681",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T15:53:19.750035Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T17:33:35.354Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/netdevsim/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0193e0660cc6",
"status": "affected",
"version": "012ec02ae441",
"versionType": "git"
},
{
"lessThan": "6eecddd9c3c8",
"status": "affected",
"version": "012ec02ae441",
"versionType": "git"
},
{
"lessThan": "d91964cdada7",
"status": "affected",
"version": "012ec02ae441",
"versionType": "git"
},
{
"lessThan": "ba5e1272142d",
"status": "affected",
"version": "012ec02ae441",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/netdevsim/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.78",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.17",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.7.*",
"status": "unaffected",
"version": "6.7.5",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.8",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetdevsim: avoid potential loop in nsim_dev_trap_report_work()\n\nMany syzbot reports include the following trace [1]\n\nIf nsim_dev_trap_report_work() can not grab the mutex,\nit should rearm itself at least one jiffie later.\n\n[1]\nSending NMI from CPU 1 to CPUs 0:\nNMI backtrace for cpu 0\nCPU: 0 PID: 32383 Comm: kworker/0:2 Not tainted 6.8.0-rc2-syzkaller-00031-g861c0981648f #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\nWorkqueue: events nsim_dev_trap_report_work\n RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:89 [inline]\n RIP: 0010:memory_is_nonzero mm/kasan/generic.c:104 [inline]\n RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [inline]\n RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline]\n RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]\n RIP: 0010:kasan_check_range+0x101/0x190 mm/kasan/generic.c:189\nCode: 07 49 39 d1 75 0a 45 3a 11 b8 01 00 00 00 7c 0b 44 89 c2 e8 21 ed ff ff 83 f0 01 5b 5d 41 5c c3 48 85 d2 74 4f 48 01 ea eb 09 \u003c48\u003e 83 c0 01 48 39 d0 74 41 80 38 00 74 f2 eb b6 41 bc 08 00 00 00\nRSP: 0018:ffffc90012dcf998 EFLAGS: 00000046\nRAX: fffffbfff258af1e RBX: fffffbfff258af1f RCX: ffffffff8168eda3\nRDX: fffffbfff258af1f RSI: 0000000000000004 RDI: ffffffff92c578f0\nRBP: fffffbfff258af1e R08: 0000000000000000 R09: fffffbfff258af1e\nR10: ffffffff92c578f3 R11: ffffffff8acbcbc0 R12: 0000000000000002\nR13: ffff88806db38400 R14: 1ffff920025b9f42 R15: ffffffff92c578e8\nFS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000c00994e078 CR3: 000000002c250000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cNMI\u003e\n \u003c/NMI\u003e\n \u003cTASK\u003e\n instrument_atomic_read include/linux/instrumented.h:68 [inline]\n atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]\n queued_spin_is_locked include/asm-generic/qspinlock.h:57 [inline]\n debug_spin_unlock kernel/locking/spinlock_debug.c:101 [inline]\n do_raw_spin_unlock+0x53/0x230 kernel/locking/spinlock_debug.c:141\n __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:150 [inline]\n _raw_spin_unlock_irqrestore+0x22/0x70 kernel/locking/spinlock.c:194\n debug_object_activate+0x349/0x540 lib/debugobjects.c:726\n debug_work_activate kernel/workqueue.c:578 [inline]\n insert_work+0x30/0x230 kernel/workqueue.c:1650\n __queue_work+0x62e/0x11d0 kernel/workqueue.c:1802\n __queue_delayed_work+0x1bf/0x270 kernel/workqueue.c:1953\n queue_delayed_work_on+0x106/0x130 kernel/workqueue.c:1989\n queue_delayed_work include/linux/workqueue.h:563 [inline]\n schedule_delayed_work include/linux/workqueue.h:677 [inline]\n nsim_dev_trap_report_work+0x9c0/0xc80 drivers/net/netdevsim/dev.c:842\n process_one_work+0x886/0x15d0 kernel/workqueue.c:2633\n process_scheduled_works kernel/workqueue.c:2706 [inline]\n worker_thread+0x8b9/0x1290 kernel/workqueue.c:2787\n kthread+0x2c6/0x3a0 kernel/kthread.c:388\n ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242\n \u003c/TASK\u003e"
}
],
"providerMetadata": {
"dateUpdated": "2024-05-29T05:20:44.527Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0193e0660cc6689c794794b471492923cfd7bfbc"
},
{
"url": "https://git.kernel.org/stable/c/6eecddd9c3c8d6e3a097531cdc6d500335b35e46"
},
{
"url": "https://git.kernel.org/stable/c/d91964cdada76740811b7c621239f9c407820dbc"
},
{
"url": "https://git.kernel.org/stable/c/ba5e1272142d051dcc57ca1d3225ad8a089f9858"
}
],
"title": "netdevsim: avoid potential loop in nsim_dev_trap_report_work()",
"x_generator": {
"engine": "bippy-a5840b7849dd"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-26681",
"datePublished": "2024-04-02T07:01:44.700Z",
"dateReserved": "2024-02-19T14:20:24.153Z",
"dateUpdated": "2024-09-11T17:33:35.354Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-26681\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-02T07:15:44.567\",\"lastModified\":\"2024-04-02T12:50:42.233\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetdevsim: avoid potential loop in nsim_dev_trap_report_work()\\n\\nMany syzbot reports include the following trace [1]\\n\\nIf nsim_dev_trap_report_work() can not grab the mutex,\\nit should rearm itself at least one jiffie later.\\n\\n[1]\\nSending NMI from CPU 1 to CPUs 0:\\nNMI backtrace for cpu 0\\nCPU: 0 PID: 32383 Comm: kworker/0:2 Not tainted 6.8.0-rc2-syzkaller-00031-g861c0981648f #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\\nWorkqueue: events nsim_dev_trap_report_work\\n RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:89 [inline]\\n RIP: 0010:memory_is_nonzero mm/kasan/generic.c:104 [inline]\\n RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [inline]\\n RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline]\\n RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]\\n RIP: 0010:kasan_check_range+0x101/0x190 mm/kasan/generic.c:189\\nCode: 07 49 39 d1 75 0a 45 3a 11 b8 01 00 00 00 7c 0b 44 89 c2 e8 21 ed ff ff 83 f0 01 5b 5d 41 5c c3 48 85 d2 74 4f 48 01 ea eb 09 \u003c48\u003e 83 c0 01 48 39 d0 74 41 80 38 00 74 f2 eb b6 41 bc 08 00 00 00\\nRSP: 0018:ffffc90012dcf998 EFLAGS: 00000046\\nRAX: fffffbfff258af1e RBX: fffffbfff258af1f RCX: ffffffff8168eda3\\nRDX: fffffbfff258af1f RSI: 0000000000000004 RDI: ffffffff92c578f0\\nRBP: fffffbfff258af1e R08: 0000000000000000 R09: fffffbfff258af1e\\nR10: ffffffff92c578f3 R11: ffffffff8acbcbc0 R12: 0000000000000002\\nR13: ffff88806db38400 R14: 1ffff920025b9f42 R15: ffffffff92c578e8\\nFS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000\\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 000000c00994e078 CR3: 000000002c250000 CR4: 00000000003506f0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nCall Trace:\\n \u003cNMI\u003e\\n \u003c/NMI\u003e\\n \u003cTASK\u003e\\n instrument_atomic_read include/linux/instrumented.h:68 [inline]\\n atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]\\n queued_spin_is_locked include/asm-generic/qspinlock.h:57 [inline]\\n debug_spin_unlock kernel/locking/spinlock_debug.c:101 [inline]\\n do_raw_spin_unlock+0x53/0x230 kernel/locking/spinlock_debug.c:141\\n __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:150 [inline]\\n _raw_spin_unlock_irqrestore+0x22/0x70 kernel/locking/spinlock.c:194\\n debug_object_activate+0x349/0x540 lib/debugobjects.c:726\\n debug_work_activate kernel/workqueue.c:578 [inline]\\n insert_work+0x30/0x230 kernel/workqueue.c:1650\\n __queue_work+0x62e/0x11d0 kernel/workqueue.c:1802\\n __queue_delayed_work+0x1bf/0x270 kernel/workqueue.c:1953\\n queue_delayed_work_on+0x106/0x130 kernel/workqueue.c:1989\\n queue_delayed_work include/linux/workqueue.h:563 [inline]\\n schedule_delayed_work include/linux/workqueue.h:677 [inline]\\n nsim_dev_trap_report_work+0x9c0/0xc80 drivers/net/netdevsim/dev.c:842\\n process_one_work+0x886/0x15d0 kernel/workqueue.c:2633\\n process_scheduled_works kernel/workqueue.c:2706 [inline]\\n worker_thread+0x8b9/0x1290 kernel/workqueue.c:2787\\n kthread+0x2c6/0x3a0 kernel/kthread.c:388\\n ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147\\n ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242\\n \u003c/TASK\u003e\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netdevsim: evita un posible bucle en nsim_dev_trap_report_work() Muchos informes de syzbot incluyen el siguiente seguimiento [1] Si nsim_dev_trap_report_work() no puede capturar el mutex, deber\u00eda rearmarse al menos un santiam\u00e9n despu\u00e9s . [1] Env\u00edo de NMI desde la CPU 1 a las CPU 0: seguimiento de NMI para la CPU 0 CPU: 0 PID: 32383 Comm: kworker/0:2 Not tainted 6.8.0-rc2-syzkaller-00031-g861c0981648f #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 17/11/2023 Cola de trabajo: eventos nsim_dev_trap_report_work RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:89 [en l\u00ednea] RIP: 0010:memory_is_nonzero mm/kasan/generic.c:104 [ en l\u00ednea] RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [en l\u00ednea] RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [en l\u00ednea] RIP: 0010:check_region_inline mm/kasan/generic.c:180 [en l\u00ednea] RIP: 0010:kasan_check_range+0x101/0x190 mm/kasan/generic.c:189 C\u00f3digo: 07 49 39 d1 75 0a 45 3a 11 b8 01 00 00 00 7c 0b 44 89 c2 e8 21 ed ff ff 83 f0 01 5b 5d 41 5c c3 48 85 d2 74 4f 48 01 ea eb 09 \u0026lt;48\u0026gt; 83 c0 01 48 39 d0 74 41 80 38 00 74 f2 eb b6 41 bc 08 00 00 00 RSP: 0018:ffffc90012dcf998 EFLAGS: 00000046 RAX: ffffbfff258af1e RBX: ffffbfff258af1f RCX: ffffffff8168eda3 RDX: ffffbfff258af1f RSI: 0000000000000004 RDI: ffffffff92c578f0 RBP: ffffbfff258af1e R08: 00000000000000000 R09: f ffffbfff258af1e R10: ffffffff92c578f3 R11: ffffffff8acbcbc0 R12: 0000000000000002 R13: ffff88806db38400 R14: 1ffff920025b9f42 R15: ffffffff92c578e8 FS: 0000 000000000000(0000) GS: ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c00994e078 CR3: 000000002c250000 CR 4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 00000000000000000 DR6: 00000000ffe0ff0 DR7: 00000 00000000400 Seguimiento de llamadas: \u0026lt; NMI\u0026gt; instrument_atomic_read include/linux/instrumented.h:68 [en l\u00ednea] atomic_read include/linux/atomic/atomic-instrumented.h:32 [en l\u00ednea] queued_spin_is_locked include/asm-generic/qspinlock.h: 57 [en l\u00ednea] debug_spin_unlock kernel/locking/spinlock_debug.c:101 [en l\u00ednea] do_raw_spin_unlock+0x53/0x230 kernel/locking/spinlock_debug.c:141 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:150 [en l\u00ednea] _raw_spin_unlock_irqrestore +0x22/0x70 n\u00facleo /locking/spinlock.c:194 debug_object_activate+0x349/0x540 lib/debugobjects.c:726 debug_work_activate kernel/workqueue.c:578 [en l\u00ednea] insert_work+0x30/0x230 kernel/workqueue.c:1650 __queue_work+0x62e/0x11d0 kernel/ workqueue.c:1802 __queue_delayed_work+0x1bf/0x270 kernel/workqueue.c:1953 queue_delayed_work_on+0x106/0x130 kernel/workqueue.c:1989 queue_delayed_work include/linux/workqueue.h:563 [en l\u00ednea] Schedule_delayed_work include/linux/workqueue.h :677 [en l\u00ednea] nsim_dev_trap_report_work+0x9c0/0xc80 drivers/net/netdevsim/dev.c:842 Process_one_work+0x886/0x15d0 kernel/workqueue.c:2633 Process_scheduled_works kernel/workqueue.c:2706 [en l\u00ednea] work_thread+0x8b9/0x1290 n\u00facleo /workqueue.c:2787 kthread+0x2c6/0x3a0 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 \"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0193e0660cc6689c794794b471492923cfd7bfbc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6eecddd9c3c8d6e3a097531cdc6d500335b35e46\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ba5e1272142d051dcc57ca1d3225ad8a089f9858\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d91964cdada76740811b7c621239f9c407820dbc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading...