cve-2023-52780
Vulnerability from cvelistv5
Published
2024-05-21 15:30
Modified
2024-08-02 23:11
Severity
Summary
net: mvneta: fix calls to page_pool_get_stats
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/00768b3e90e648227eaa959d9d279f5e32823df1
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/230dc06e2495487d88b3410da055bb618febb19b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2b0e99072654edd601d05c0061a20337af5008ba
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ca8add922f9c7f6e2e3c71039da8e0dcc64b87ed
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52780",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:36:55.897084Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:37:20.654Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:36.011Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/00768b3e90e648227eaa959d9d279f5e32823df1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/230dc06e2495487d88b3410da055bb618febb19b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2b0e99072654edd601d05c0061a20337af5008ba"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ca8add922f9c7f6e2e3c71039da8e0dcc64b87ed"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/mvneta.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "00768b3e90e6",
              "status": "affected",
              "version": "b3fc79225f05",
              "versionType": "git"
            },
            {
              "lessThan": "230dc06e2495",
              "status": "affected",
              "version": "b3fc79225f05",
              "versionType": "git"
            },
            {
              "lessThan": "2b0e99072654",
              "status": "affected",
              "version": "b3fc79225f05",
              "versionType": "git"
            },
            {
              "lessThan": "ca8add922f9c",
              "status": "affected",
              "version": "b3fc79225f05",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/mvneta.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.64",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.13",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.7",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvneta: fix calls to page_pool_get_stats\n\nCalling page_pool_get_stats in the mvneta driver without checks\nleads to kernel crashes.\nFirst the page pool is only available if the bm is not used.\nThe page pool is also not allocated when the port is stopped.\nIt can also be not allocated in case of errors.\n\nThe current implementation leads to the following crash calling\nethstats on a port that is down or when calling it at the wrong moment:\n\nble to handle kernel NULL pointer dereference at virtual address 00000070\n[00000070] *pgd=00000000\nInternal error: Oops: 5 [#1] SMP ARM\nHardware name: Marvell Armada 380/385 (Device Tree)\nPC is at page_pool_get_stats+0x18/0x1cc\nLR is at mvneta_ethtool_get_stats+0xa0/0xe0 [mvneta]\npc : [\u003cc0b413cc\u003e]    lr : [\u003cbf0a98d8\u003e]    psr: a0000013\nsp : f1439d48  ip : f1439dc0  fp : 0000001d\nr10: 00000100  r9 : c4816b80  r8 : f0d75150\nr7 : bf0b400c  r6 : c238f000  r5 : 00000000  r4 : f1439d68\nr3 : c2091040  r2 : ffffffd8  r1 : f1439d68  r0 : 00000000\nFlags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none\nControl: 10c5387d  Table: 066b004a  DAC: 00000051\nRegister r0 information: NULL pointer\nRegister r1 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390\nRegister r2 information: non-paged memory\nRegister r3 information: slab kmalloc-2k start c2091000 pointer offset 64 size 2048\nRegister r4 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390\nRegister r5 information: NULL pointer\nRegister r6 information: slab kmalloc-cg-4k start c238f000 pointer offset 0 size 4096\nRegister r7 information: 15-page vmalloc region starting at 0xbf0a8000 allocated at load_module+0xa30/0x219c\nRegister r8 information: 1-page vmalloc region starting at 0xf0d75000 allocated at ethtool_get_stats+0x138/0x208\nRegister r9 information: slab task_struct start c4816b80 pointer offset 0\nRegister r10 information: non-paged memory\nRegister r11 information: non-paged memory\nRegister r12 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390\nProcess snmpd (pid: 733, stack limit = 0x38de3a88)\nStack: (0xf1439d48 to 0xf143a000)\n9d40:                   000000c0 00000001 c238f000 bf0b400c f0d75150 c4816b80\n9d60: 00000100 bf0a98d8 00000000 00000000 00000000 00000000 00000000 00000000\n9d80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000\n9da0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000\n9dc0: 00000dc0 5335509c 00000035 c238f000 bf0b2214 01067f50 f0d75000 c0b9b9c8\n9de0: 0000001d 00000035 c2212094 5335509c c4816b80 c238f000 c5ad6e00 01067f50\n9e00: c1b0be80 c4816b80 00014813 c0b9d7f0 00000000 00000000 0000001d 0000001d\n9e20: 00000000 00001200 00000000 00000000 c216ed90 c73943b8 00000000 00000000\n9e40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000\n9e60: 00000000 c0ad9034 00000000 00000000 00000000 00000000 00000000 00000000\n9e80: 00000000 00000000 00000000 5335509c c1b0be80 f1439ee4 00008946 c1b0be80\n9ea0: 01067f50 f1439ee3 00000000 00000046 b6d77ae0 c0b383f0 00008946 becc83e8\n9ec0: c1b0be80 00000051 0000000b c68ca480 c7172d00 c0ad8ff0 f1439ee3 cf600e40\n9ee0: 01600e40 32687465 00000000 00000000 00000000 01067f50 00000000 00000000\n9f00: 00000000 5335509c 00008946 00008946 00000000 c68ca480 becc83e8 c05e2de0\n9f20: f1439fb0 c03002f0 00000006 5ac3c35a c4816b80 00000006 b6d77ae0 c030caf0\n9f40: c4817350 00000014 f1439e1c 0000000c 00000000 00000051 01000000 00000014\n9f60: 00003fec f1439edc 00000001 c0372abc b6d77ae0 c0372abc cf600e40 5335509c\n9f80: c21e6800 01015c9c 0000000b 00008946 00000036 c03002f0 c4816b80 00000036\n9fa0: b6d77ae0 c03000c0 01015c9c 0000000b 0000000b 00008946 becc83e8 00000000\n9fc0: 01015c9c 0000000b 00008946 00000036 00000035 010678a0 b6d797ec b6d77ae0\n9fe0: b6dbf738 becc838c b6d186d7 b6baa858 40000030 0000000b 00000000 00000000\n page_pool_get_s\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:17:13.375Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/00768b3e90e648227eaa959d9d279f5e32823df1"
        },
        {
          "url": "https://git.kernel.org/stable/c/230dc06e2495487d88b3410da055bb618febb19b"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b0e99072654edd601d05c0061a20337af5008ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca8add922f9c7f6e2e3c71039da8e0dcc64b87ed"
        }
      ],
      "title": "net: mvneta: fix calls to page_pool_get_stats",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52780",
    "datePublished": "2024-05-21T15:30:59.557Z",
    "dateReserved": "2024-05-21T15:19:24.240Z",
    "dateUpdated": "2024-08-02T23:11:36.011Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52780\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T16:15:16.957\",\"lastModified\":\"2024-05-21T16:53:56.550\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: mvneta: fix calls to page_pool_get_stats\\n\\nCalling page_pool_get_stats in the mvneta driver without checks\\nleads to kernel crashes.\\nFirst the page pool is only available if the bm is not used.\\nThe page pool is also not allocated when the port is stopped.\\nIt can also be not allocated in case of errors.\\n\\nThe current implementation leads to the following crash calling\\nethstats on a port that is down or when calling it at the wrong moment:\\n\\nble to handle kernel NULL pointer dereference at virtual address 00000070\\n[00000070] *pgd=00000000\\nInternal error: Oops: 5 [#1] SMP ARM\\nHardware name: Marvell Armada 380/385 (Device Tree)\\nPC is at page_pool_get_stats+0x18/0x1cc\\nLR is at mvneta_ethtool_get_stats+0xa0/0xe0 [mvneta]\\npc : [\u003cc0b413cc\u003e]    lr : [\u003cbf0a98d8\u003e]    psr: a0000013\\nsp : f1439d48  ip : f1439dc0  fp : 0000001d\\nr10: 00000100  r9 : c4816b80  r8 : f0d75150\\nr7 : bf0b400c  r6 : c238f000  r5 : 00000000  r4 : f1439d68\\nr3 : c2091040  r2 : ffffffd8  r1 : f1439d68  r0 : 00000000\\nFlags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none\\nControl: 10c5387d  Table: 066b004a  DAC: 00000051\\nRegister r0 information: NULL pointer\\nRegister r1 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390\\nRegister r2 information: non-paged memory\\nRegister r3 information: slab kmalloc-2k start c2091000 pointer offset 64 size 2048\\nRegister r4 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390\\nRegister r5 information: NULL pointer\\nRegister r6 information: slab kmalloc-cg-4k start c238f000 pointer offset 0 size 4096\\nRegister r7 information: 15-page vmalloc region starting at 0xbf0a8000 allocated at load_module+0xa30/0x219c\\nRegister r8 information: 1-page vmalloc region starting at 0xf0d75000 allocated at ethtool_get_stats+0x138/0x208\\nRegister r9 information: slab task_struct start c4816b80 pointer offset 0\\nRegister r10 information: non-paged memory\\nRegister r11 information: non-paged memory\\nRegister r12 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390\\nProcess snmpd (pid: 733, stack limit = 0x38de3a88)\\nStack: (0xf1439d48 to 0xf143a000)\\n9d40:                   000000c0 00000001 c238f000 bf0b400c f0d75150 c4816b80\\n9d60: 00000100 bf0a98d8 00000000 00000000 00000000 00000000 00000000 00000000\\n9d80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000\\n9da0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000\\n9dc0: 00000dc0 5335509c 00000035 c238f000 bf0b2214 01067f50 f0d75000 c0b9b9c8\\n9de0: 0000001d 00000035 c2212094 5335509c c4816b80 c238f000 c5ad6e00 01067f50\\n9e00: c1b0be80 c4816b80 00014813 c0b9d7f0 00000000 00000000 0000001d 0000001d\\n9e20: 00000000 00001200 00000000 00000000 c216ed90 c73943b8 00000000 00000000\\n9e40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000\\n9e60: 00000000 c0ad9034 00000000 00000000 00000000 00000000 00000000 00000000\\n9e80: 00000000 00000000 00000000 5335509c c1b0be80 f1439ee4 00008946 c1b0be80\\n9ea0: 01067f50 f1439ee3 00000000 00000046 b6d77ae0 c0b383f0 00008946 becc83e8\\n9ec0: c1b0be80 00000051 0000000b c68ca480 c7172d00 c0ad8ff0 f1439ee3 cf600e40\\n9ee0: 01600e40 32687465 00000000 00000000 00000000 01067f50 00000000 00000000\\n9f00: 00000000 5335509c 00008946 00008946 00000000 c68ca480 becc83e8 c05e2de0\\n9f20: f1439fb0 c03002f0 00000006 5ac3c35a c4816b80 00000006 b6d77ae0 c030caf0\\n9f40: c4817350 00000014 f1439e1c 0000000c 00000000 00000051 01000000 00000014\\n9f60: 00003fec f1439edc 00000001 c0372abc b6d77ae0 c0372abc cf600e40 5335509c\\n9f80: c21e6800 01015c9c 0000000b 00008946 00000036 c03002f0 c4816b80 00000036\\n9fa0: b6d77ae0 c03000c0 01015c9c 0000000b 0000000b 00008946 becc83e8 00000000\\n9fc0: 01015c9c 0000000b 00008946 00000036 00000035 010678a0 b6d797ec b6d77ae0\\n9fe0: b6dbf738 becc838c b6d186d7 b6baa858 40000030 0000000b 00000000 00000000\\n page_pool_get_s\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: mvneta: corrige llamadas a page_pool_get_stats. Llamar a page_pool_get_stats en el controlador mvneta sin comprobaciones provoca fallos del kernel. Primero, el grupo de p\u00e1ginas solo est\u00e1 disponible si no se utiliza bm. El grupo de p\u00e1ginas tampoco se asigna cuando se detiene el puerto. Tambi\u00e9n se puede no asignar en caso de errores. La implementaci\u00f3n actual provoca el siguiente fallo al llamar a ethstats en un puerto que est\u00e1 inactivo o al llamarlo en el momento equivocado: ble para manejar la desreferencia del puntero NULL del kernel en la direcci\u00f3n virtual 00000070 [00000070] *pgd=00000000 Error interno: Ups: 5 [ #1] Nombre del hardware SMP ARM: Marvell Armada 380/385 (\u00e1rbol de dispositivos) La PC est\u00e1 en page_pool_get_stats+0x18/0x1cc LR est\u00e1 en mvneta_ethtool_get_stats+0xa0/0xe0 [mvneta] pc: [] lr: [] psr: a0000013 sp: f1439d48 ip: f1439dc0 fp: 0000001d r10: 00000100 r9: c4816b80 r8: f0d75150 r7: bf0b400c r6: c238f000 r5: 00000000 : f1439d68 r3 : c2091040 r2 : ffffffd8 r1 : f1439d68 r0 : 00000000 Banderas: NzCv IRQ activadas FIQ en modo SVC_32 ISA ARM Segmento ninguno Control: 10c5387d Tabla: 066b004a DAC: 00000051 Informaci\u00f3n del registro r0: puntero NULL Informaci\u00f3n del registro r1: regi\u00f3n vmalloc de 2 p\u00e1ginas que comienza en 0xf1438000 asignada en kernel_clone+0x9c/0x390 Informaci\u00f3n del registro r2: memoria no paginada Registre informaci\u00f3n de r3: slab kmalloc-2k start c2091000 desplazamiento del puntero 64 tama\u00f1o 2048 Registre informaci\u00f3n de r4: regi\u00f3n vmalloc de 2 p\u00e1ginas que comienza en 0xf1438000 asignada en kernel_clone+0x9c/0x390 Registre informaci\u00f3n de r5: puntero NULL Registre informaci\u00f3n de r6: slab kmalloc-cg-4k inicio c238f000 desplazamiento del puntero 0 tama\u00f1o 4096 Informaci\u00f3n del registro r7: regi\u00f3n vmalloc de 15 p\u00e1ginas que comienza en 0xbf0a8000 asignada en load_module+0xa30/0x219c Informaci\u00f3n del registro r8: regi\u00f3n vmalloc de 1 p\u00e1gina que comienza en 0xf0d75000 asignada en ethtool_get_stats+0x138/0x208 Informaci\u00f3n del registro r9: laboratorio task_struct start c4816b80 desplazamiento del puntero 0 Registrar informaci\u00f3n r10: memoria no paginada Registrar informaci\u00f3n r11: memoria no paginada Registrar informaci\u00f3n r12: regi\u00f3n vmalloc de 2 p\u00e1ginas que comienza en 0xf1438000 asignada en kernel_clone+0x9c/0x390 Procesar snmpd (pid: 733, l\u00edmite de pila = 0x38de3a88) Pila: (0xf1439d48 a 0xf143a000) 9d40: 000000c0 00000001 c238f000 bf0b400c f0d75150 c4816b80 9d60: 00000100 bf0a98d8 000 00000000 00000000 00000000 00000000 00000000 9d80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 000000 00 9da0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9dc0: 00000dc0 5335509c 00000035 c238f000 bf0b2214 01067f50 f0d75000 c0b9b9c8 9de0: 0000001d 00000035 c2212094 5335509c c4816b80 0 c5ad6e00 01067f50 9e00: c1b0be80 c4816b80 00014813 c0b9d7f0 00000000 00000000 0000001d 0000001d 9e20: 00000000 00001200 00000000 00000000 c216ed90 c73943b8 00000000 00000000 9e40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9e6 0: 00000000 c0ad9034 00000000 00000000 00000000 00000000 00000000 00000000 9e80: 00000000 00000000 00000000 5335509c c1b0be80 9ee4 00008946 c1b0be80 9ea0: 01067f50 f1439ee3 00000000 00000046 b6d77ae0 c0b383f0 00008946 becc83e8 9ec0: c1b0be80 00000051 0000000b c68ca48 0 c7172d00 c0ad8ff0 f1439ee3 cf600e40 9ee0: 01600e40 32687465 00000000 00000000 00000000 01067f50 00000000 00000000 9f00: 00000000 5335509c 00008946 00008946 00000000 c68ca480 becc83e8 c05e2de0 9f20: f1439fb0 c03002f0 00000006 5ac3c35a c4816b80 00000006 b6 d77ae0 c030caf0 9f40: c4817350 00000014 f1439e1c 0000000c 00000000 00000051 01000000 00000014 9f60: 00003fec f1439edc 00000001 c0372abc b6d77ae0 c0372abc cf600e40 5335509c 9f80: c21e6800 01015c9c 0000000b 00008946 00000036 c03002f0 c4816b80 00000036 9fa0: b6d77ae0 c03000c0 01015c9c 0000000b 0000000b 00008946 becc83e8 00000000 9fc0: 01015c9c 0000000b 00008946 00000036 00000035 8a0 b6d797ec b6d77ae0 -truncado-\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/00768b3e90e648227eaa959d9d279f5e32823df1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/230dc06e2495487d88b3410da055bb618febb19b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2b0e99072654edd601d05c0061a20337af5008ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ca8add922f9c7f6e2e3c71039da8e0dcc64b87ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.