cve-2024-26838
Vulnerability from cvelistv5
Published
2024-04-17 10:10
Modified
2024-08-02 00:14
Severity
Summary
RDMA/irdma: Fix KASAN issue with tasklet
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0ae8ad0013978f7471f22bcf45b027393e87f5dc
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/635d79aa477f9912e602feb5498bdd51fb9cb824
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b2e4a5266e3d133b4c7f0e43bf40d13ce14fd1aa
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bd97cea7b18a0a553773af806dfbfac27a7c4acb
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c6f1ca235f68b22b3e691b2ea87ac285e5946848
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26838",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-10T14:27:19.140994Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:48:36.256Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.672Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/635d79aa477f9912e602feb5498bdd51fb9cb824"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b2e4a5266e3d133b4c7f0e43bf40d13ce14fd1aa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c6f1ca235f68b22b3e691b2ea87ac285e5946848"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0ae8ad0013978f7471f22bcf45b027393e87f5dc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bd97cea7b18a0a553773af806dfbfac27a7c4acb"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/irdma/hw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "635d79aa477f",
              "status": "affected",
              "version": "44d9e52977a1",
              "versionType": "git"
            },
            {
              "lessThan": "b2e4a5266e3d",
              "status": "affected",
              "version": "44d9e52977a1",
              "versionType": "git"
            },
            {
              "lessThan": "c6f1ca235f68",
              "status": "affected",
              "version": "44d9e52977a1",
              "versionType": "git"
            },
            {
              "lessThan": "0ae8ad001397",
              "status": "affected",
              "version": "44d9e52977a1",
              "versionType": "git"
            },
            {
              "lessThan": "bd97cea7b18a",
              "status": "affected",
              "version": "44d9e52977a1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/irdma/hw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.150",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.80",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.19",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix KASAN issue with tasklet\n\nKASAN testing revealed the following issue assocated with freeing an IRQ.\n\n[50006.466686] Call Trace:\n[50006.466691]  \u003cIRQ\u003e\n[50006.489538]  dump_stack+0x5c/0x80\n[50006.493475]  print_address_description.constprop.6+0x1a/0x150\n[50006.499872]  ? irdma_sc_process_ceq+0x483/0x790 [irdma]\n[50006.505742]  ? irdma_sc_process_ceq+0x483/0x790 [irdma]\n[50006.511644]  kasan_report.cold.11+0x7f/0x118\n[50006.516572]  ? irdma_sc_process_ceq+0x483/0x790 [irdma]\n[50006.522473]  irdma_sc_process_ceq+0x483/0x790 [irdma]\n[50006.528232]  irdma_process_ceq+0xb2/0x400 [irdma]\n[50006.533601]  ? irdma_hw_flush_wqes_callback+0x370/0x370 [irdma]\n[50006.540298]  irdma_ceq_dpc+0x44/0x100 [irdma]\n[50006.545306]  tasklet_action_common.isra.14+0x148/0x2c0\n[50006.551096]  __do_softirq+0x1d0/0xaf8\n[50006.555396]  irq_exit_rcu+0x219/0x260\n[50006.559670]  irq_exit+0xa/0x20\n[50006.563320]  smp_apic_timer_interrupt+0x1bf/0x690\n[50006.568645]  apic_timer_interrupt+0xf/0x20\n[50006.573341]  \u003c/IRQ\u003e\n\nThe issue is that a tasklet could be pending on another core racing\nthe delete of the irq.\n\nFix by insuring any scheduled tasklet is killed after deleting the\nirq."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:23:36.373Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/635d79aa477f9912e602feb5498bdd51fb9cb824"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2e4a5266e3d133b4c7f0e43bf40d13ce14fd1aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6f1ca235f68b22b3e691b2ea87ac285e5946848"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ae8ad0013978f7471f22bcf45b027393e87f5dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd97cea7b18a0a553773af806dfbfac27a7c4acb"
        }
      ],
      "title": "RDMA/irdma: Fix KASAN issue with tasklet",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26838",
    "datePublished": "2024-04-17T10:10:04.871Z",
    "dateReserved": "2024-02-19T14:20:24.182Z",
    "dateUpdated": "2024-08-02T00:14:13.672Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26838\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-17T10:15:09.810\",\"lastModified\":\"2024-04-17T12:48:07.510\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/irdma: Fix KASAN issue with tasklet\\n\\nKASAN testing revealed the following issue assocated with freeing an IRQ.\\n\\n[50006.466686] Call Trace:\\n[50006.466691]  \u003cIRQ\u003e\\n[50006.489538]  dump_stack+0x5c/0x80\\n[50006.493475]  print_address_description.constprop.6+0x1a/0x150\\n[50006.499872]  ? irdma_sc_process_ceq+0x483/0x790 [irdma]\\n[50006.505742]  ? irdma_sc_process_ceq+0x483/0x790 [irdma]\\n[50006.511644]  kasan_report.cold.11+0x7f/0x118\\n[50006.516572]  ? irdma_sc_process_ceq+0x483/0x790 [irdma]\\n[50006.522473]  irdma_sc_process_ceq+0x483/0x790 [irdma]\\n[50006.528232]  irdma_process_ceq+0xb2/0x400 [irdma]\\n[50006.533601]  ? irdma_hw_flush_wqes_callback+0x370/0x370 [irdma]\\n[50006.540298]  irdma_ceq_dpc+0x44/0x100 [irdma]\\n[50006.545306]  tasklet_action_common.isra.14+0x148/0x2c0\\n[50006.551096]  __do_softirq+0x1d0/0xaf8\\n[50006.555396]  irq_exit_rcu+0x219/0x260\\n[50006.559670]  irq_exit+0xa/0x20\\n[50006.563320]  smp_apic_timer_interrupt+0x1bf/0x690\\n[50006.568645]  apic_timer_interrupt+0xf/0x20\\n[50006.573341]  \u003c/IRQ\u003e\\n\\nThe issue is that a tasklet could be pending on another core racing\\nthe delete of the irq.\\n\\nFix by insuring any scheduled tasklet is killed after deleting the\\nirq.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: RDMA/irdma: solucione el problema de KASAN con el tasklet Las pruebas de KASAN revelaron el siguiente problema asociado con la liberaci\u00f3n de una IRQ. [50006.466686] Seguimiento de llamadas: [50006.466691]  [50006.489538] dump_stack+0x5c/0x80 [50006.493475] print_address_description.constprop.6+0x1a/0x150 [50006.499872] ? irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.505742] ? irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.511644] kasan_report.cold.11+0x7f/0x118 [50006.516572] ? irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.522473] irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.528232] irdma_process_ceq+0xb2/0x400 [irdma] [50006.536.53601 irdma_hw_flush_wqes_callback+0x370/0x370 [irdma] [50006.540298] irdma_ceq_dpc+0x44/0x100 [irdma] [50006.545306] tasklet_action_common.isra.14+0x148/0x2c0 [50006.551096 ] __do_softirq+0x1d0/0xaf8 [50006.555396] irq_exit_rcu+0x219/0x260 [50006.559670] irq_exit+0xa/0x20 [50006.563320] smp_apic_timer_interrupt+0x1bf/0x690 [50006.568645] apic_timer_interrupt+0xf/0x20 [50006.573341]  El problema es que un tasklet podr\u00eda estar pendiente en otro n\u00facleo acelerando la eliminaci\u00f3n del irq. Soluci\u00f3n asegur\u00e1ndose de que cualquier tasklet programado se elimine despu\u00e9s de eliminar el irq.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0ae8ad0013978f7471f22bcf45b027393e87f5dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/635d79aa477f9912e602feb5498bdd51fb9cb824\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b2e4a5266e3d133b4c7f0e43bf40d13ce14fd1aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bd97cea7b18a0a553773af806dfbfac27a7c4acb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c6f1ca235f68b22b3e691b2ea87ac285e5946848\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.