cve-2024-26803
Vulnerability from cvelistv5
Published
2024-04-04 08:20
Modified
2024-09-11 17:33
Severity
Summary
net: veth: clear GRO when clearing XDP even when down
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/16edf51f33f52dff70ed455bc40a6cc443c04664
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7985d73961bbb4e726c1be7b9cd26becc7be8325
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8f7a3894e58e6f5d5815533cfde60e3838947941
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f011c103e654d83dc85f057a7d1bd0960d02831c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fe9f801355f0b47668419f30f1fac1cf4539e736
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.524Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f011c103e654d83dc85f057a7d1bd0960d02831c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7985d73961bbb4e726c1be7b9cd26becc7be8325"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/16edf51f33f52dff70ed455bc40a6cc443c04664"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8f7a3894e58e6f5d5815533cfde60e3838947941"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fe9f801355f0b47668419f30f1fac1cf4539e736"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26803",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:50:46.385244Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:47.163Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/veth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f011c103e654",
              "status": "affected",
              "version": "d3256efd8e8b",
              "versionType": "git"
            },
            {
              "lessThan": "7985d73961bb",
              "status": "affected",
              "version": "d3256efd8e8b",
              "versionType": "git"
            },
            {
              "lessThan": "16edf51f33f5",
              "status": "affected",
              "version": "d3256efd8e8b",
              "versionType": "git"
            },
            {
              "lessThan": "8f7a3894e58e",
              "status": "affected",
              "version": "d3256efd8e8b",
              "versionType": "git"
            },
            {
              "lessThan": "fe9f801355f0",
              "status": "affected",
              "version": "d3256efd8e8b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/veth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.151",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.81",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.21",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.9",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: veth: clear GRO when clearing XDP even when down\n\nveth sets NETIF_F_GRO automatically when XDP is enabled,\nbecause both features use the same NAPI machinery.\n\nThe logic to clear NETIF_F_GRO sits in veth_disable_xdp() which\nis called both on ndo_stop and when XDP is turned off.\nTo avoid the flag from being cleared when the device is brought\ndown, the clearing is skipped when IFF_UP is not set.\nBringing the device down should indeed not modify its features.\n\nUnfortunately, this means that clearing is also skipped when\nXDP is disabled _while_ the device is down. And there\u0027s nothing\non the open path to bring the device features back into sync.\nIOW if user enables XDP, disables it and then brings the device\nup we\u0027ll end up with a stray GRO flag set but no NAPI instances.\n\nWe don\u0027t depend on the GRO flag on the datapath, so the datapath\nwon\u0027t crash. We will crash (or hang), however, next time features\nare sync\u0027ed (either by user via ethtool or peer changing its config).\nThe GRO flag will go away, and veth will try to disable the NAPIs.\nBut the open path never created them since XDP was off, the GRO flag\nwas a stray. If NAPI was initialized before we\u0027ll hang in napi_disable().\nIf it never was we\u0027ll crash trying to stop uninitialized hrtimer.\n\nMove the GRO flag updates to the XDP enable / disable paths,\ninstead of mixing them with the ndo_open / ndo_close paths."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:23:03.125Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f011c103e654d83dc85f057a7d1bd0960d02831c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7985d73961bbb4e726c1be7b9cd26becc7be8325"
        },
        {
          "url": "https://git.kernel.org/stable/c/16edf51f33f52dff70ed455bc40a6cc443c04664"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f7a3894e58e6f5d5815533cfde60e3838947941"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe9f801355f0b47668419f30f1fac1cf4539e736"
        }
      ],
      "title": "net: veth: clear GRO when clearing XDP even when down",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26803",
    "datePublished": "2024-04-04T08:20:30.656Z",
    "dateReserved": "2024-02-19T14:20:24.179Z",
    "dateUpdated": "2024-09-11T17:33:47.163Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26803\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-04T09:15:09.163\",\"lastModified\":\"2024-04-04T12:48:22.650\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: veth: clear GRO when clearing XDP even when down\\n\\nveth sets NETIF_F_GRO automatically when XDP is enabled,\\nbecause both features use the same NAPI machinery.\\n\\nThe logic to clear NETIF_F_GRO sits in veth_disable_xdp() which\\nis called both on ndo_stop and when XDP is turned off.\\nTo avoid the flag from being cleared when the device is brought\\ndown, the clearing is skipped when IFF_UP is not set.\\nBringing the device down should indeed not modify its features.\\n\\nUnfortunately, this means that clearing is also skipped when\\nXDP is disabled _while_ the device is down. And there\u0027s nothing\\non the open path to bring the device features back into sync.\\nIOW if user enables XDP, disables it and then brings the device\\nup we\u0027ll end up with a stray GRO flag set but no NAPI instances.\\n\\nWe don\u0027t depend on the GRO flag on the datapath, so the datapath\\nwon\u0027t crash. We will crash (or hang), however, next time features\\nare sync\u0027ed (either by user via ethtool or peer changing its config).\\nThe GRO flag will go away, and veth will try to disable the NAPIs.\\nBut the open path never created them since XDP was off, the GRO flag\\nwas a stray. If NAPI was initialized before we\u0027ll hang in napi_disable().\\nIf it never was we\u0027ll crash trying to stop uninitialized hrtimer.\\n\\nMove the GRO flag updates to the XDP enable / disable paths,\\ninstead of mixing them with the ndo_open / ndo_close paths.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: veth: borra GRO al borrar XDP incluso cuando est\u00e1 desactivado veth configura NETIF_F_GRO autom\u00e1ticamente cuando XDP est\u00e1 habilitado, porque ambas funciones utilizan la misma maquinaria NAPI. La l\u00f3gica para borrar NETIF_F_GRO se encuentra en veth_disable_xdp(), que se llama tanto en ndo_stop como cuando XDP est\u00e1 desactivado. Para evitar que la bandera se borre cuando se baja el dispositivo, la eliminaci\u00f3n se omite cuando IFF_UP no est\u00e1 configurado. De hecho, bajar el dispositivo no deber\u00eda modificar sus caracter\u00edsticas. Desafortunadamente, esto significa que la limpieza tambi\u00e9n se omite cuando XDP est\u00e1 deshabilitado _mientras_ el dispositivo est\u00e1 inactivo. Y no hay nada en el camino abierto para volver a sincronizar las funciones del dispositivo. IOW, si el usuario habilita XDP, lo deshabilita y luego enciende el dispositivo, terminaremos con un indicador GRO perdido pero sin instancias NAPI. No dependemos del indicador GRO en la ruta de datos, por lo que la ruta de datos no fallar\u00e1. Nos bloquearemos (o colgaremos), sin embargo, la pr\u00f3xima vez que se sincronicen las funciones (ya sea por el usuario a trav\u00e9s de ethtool o por un compa\u00f1ero cambiando su configuraci\u00f3n). La bandera GRO desaparecer\u00e1 y Veth intentar\u00e1 desactivar las NAPI. Pero el camino abierto nunca los cre\u00f3 ya que XDP estaba desactivado, la bandera GRO estaba perdida. Si NAPI se inicializ\u00f3 antes, colgaremos napi_disable(). Si nunca fue as\u00ed, fallaremos al intentar detener el hrtimer no inicializado. Mueva las actualizaciones del indicador GRO a las rutas de activaci\u00f3n/desactivaci\u00f3n de XDP, en lugar de mezclarlas con las rutas ndo_open/ndo_close.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/16edf51f33f52dff70ed455bc40a6cc443c04664\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7985d73961bbb4e726c1be7b9cd26becc7be8325\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8f7a3894e58e6f5d5815533cfde60e3838947941\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f011c103e654d83dc85f057a7d1bd0960d02831c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fe9f801355f0b47668419f30f1fac1cf4539e736\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.