CVE-2024-26858
Vulnerability from cvelistv5
Published
2024-04-17 10:17
Modified
2024-12-19 08:48
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map Just simply reordering the functions mlx5e_ptp_metadata_map_put and mlx5e_ptpsq_track_metadata in the mlx5e_txwqe_complete context is not good enough since both the compiler and CPU are free to reorder these two functions. If reordering does occur, the issue that was supposedly fixed by 7e3f3ba97e6c ("net/mlx5e: Track xmit submission to PTP WQ after populating metadata map") will be seen. This will lead to NULL pointer dereferences in mlx5e_ptpsq_mark_ts_cqes_undelivered in the NAPI polling context due to the tracking list being populated before the metadata map.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/936ef086161ab89a7f38f7a0761d6a3063c3277e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b7cf07586c40f926063d4d09f7de28ff82f62b2a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d1f71615dbb305f14f3b756cce015d70d8667549
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/936ef086161ab89a7f38f7a0761d6a3063c3277e
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/b7cf07586c40f926063d4d09f7de28ff82f62b2a
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/d1f71615dbb305f14f3b756cce015d70d8667549
Impacted products
Vendor Product Version
Linux Linux Version: 6.7
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26858",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:41:34.337200Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:48:26.372Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.697Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d1f71615dbb305f14f3b756cce015d70d8667549"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/936ef086161ab89a7f38f7a0761d6a3063c3277e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b7cf07586c40f926063d4d09f7de28ff82f62b2a"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d1f71615dbb305f14f3b756cce015d70d8667549",
              "status": "affected",
              "version": "4d510506b46504664eacf8a44a9e8f3e54c137b8",
              "versionType": "git"
            },
            {
              "lessThan": "936ef086161ab89a7f38f7a0761d6a3063c3277e",
              "status": "affected",
              "version": "7e3f3ba97e6cc6fce5bf62df2ca06c8e59040167",
              "versionType": "git"
            },
            {
              "lessThan": "b7cf07586c40f926063d4d09f7de28ff82f62b2a",
              "status": "affected",
              "version": "7e3f3ba97e6cc6fce5bf62df2ca06c8e59040167",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map\n\nJust simply reordering the functions mlx5e_ptp_metadata_map_put and\nmlx5e_ptpsq_track_metadata in the mlx5e_txwqe_complete context is not good\nenough since both the compiler and CPU are free to reorder these two\nfunctions. If reordering does occur, the issue that was supposedly fixed by\n7e3f3ba97e6c (\"net/mlx5e: Track xmit submission to PTP WQ after populating\nmetadata map\") will be seen. This will lead to NULL pointer dereferences in\nmlx5e_ptpsq_mark_ts_cqes_undelivered in the NAPI polling context due to the\ntracking list being populated before the metadata map."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:48:50.087Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d1f71615dbb305f14f3b756cce015d70d8667549"
        },
        {
          "url": "https://git.kernel.org/stable/c/936ef086161ab89a7f38f7a0761d6a3063c3277e"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7cf07586c40f926063d4d09f7de28ff82f62b2a"
        }
      ],
      "title": "net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26858",
    "datePublished": "2024-04-17T10:17:19.757Z",
    "dateReserved": "2024-02-19T14:20:24.183Z",
    "dateUpdated": "2024-12-19T08:48:50.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26858\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-17T11:15:08.840\",\"lastModified\":\"2024-11-21T09:03:13.893\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map\\n\\nJust simply reordering the functions mlx5e_ptp_metadata_map_put and\\nmlx5e_ptpsq_track_metadata in the mlx5e_txwqe_complete context is not good\\nenough since both the compiler and CPU are free to reorder these two\\nfunctions. If reordering does occur, the issue that was supposedly fixed by\\n7e3f3ba97e6c (\\\"net/mlx5e: Track xmit submission to PTP WQ after populating\\nmetadata map\\\") will be seen. This will lead to NULL pointer dereferences in\\nmlx5e_ptpsq_mark_ts_cqes_undelivered in the NAPI polling context due to the\\ntracking list being populated before the metadata map.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5e: use una barrera de memoria para aplicar PTP WQ. El seguimiento de env\u00edo xmit ocurre despu\u00e9s de completar metadata_map. Simplemente reordenar las funciones mlx5e_ptp_metadata_map_put y mlx5e_ptpsq_track_metadata en el contexto mlx5e_txwqe_complete no es lo suficientemente bueno ya que ambas el compilador y la CPU son libres de reordenar estas dos funciones. Si se produce un reordenamiento, se ver\u00e1 el problema que supuestamente fue solucionado por 7e3f3ba97e6c (\\\"net/mlx5e: Seguimiento del env\u00edo de xmit a PTP WQ despu\u00e9s de completar el mapa de metadatos\\\"). Esto dar\u00e1 lugar a desreferencias de puntero NULL en mlx5e_ptpsq_mark_ts_cqes_undelivered en el contexto de sondeo NAPI debido a que la lista de seguimiento se completa antes del mapa de metadatos.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/936ef086161ab89a7f38f7a0761d6a3063c3277e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b7cf07586c40f926063d4d09f7de28ff82f62b2a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d1f71615dbb305f14f3b756cce015d70d8667549\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/936ef086161ab89a7f38f7a0761d6a3063c3277e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/b7cf07586c40f926063d4d09f7de28ff82f62b2a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/d1f71615dbb305f14f3b756cce015d70d8667549\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.