cve-2024-26953
Vulnerability from cvelistv5
Published
2024-05-01 05:18
Modified
2024-09-11 17:33
Severity
Summary
net: esp: fix bad handling of pages from page_pool
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1abb20a5f4b02fb3020f88456fc1e6069b3cdc45
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8291b4eac429c480386669444c6377573f5d8664
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c3198822c6cb9fb588e446540485669cc81c5d34
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f278ff9db67264715d0d50e3e75044f8b78990f4
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.778Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8291b4eac429c480386669444c6377573f5d8664"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1abb20a5f4b02fb3020f88456fc1e6069b3cdc45"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f278ff9db67264715d0d50e3e75044f8b78990f4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c3198822c6cb9fb588e446540485669cc81c5d34"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26953",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:45:33.246768Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:48.971Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/skbuff.h",
            "net/ipv4/esp4.c",
            "net/ipv6/esp6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8291b4eac429",
              "status": "affected",
              "version": "6a5bcd84e886",
              "versionType": "git"
            },
            {
              "lessThan": "1abb20a5f4b0",
              "status": "affected",
              "version": "6a5bcd84e886",
              "versionType": "git"
            },
            {
              "lessThan": "f278ff9db672",
              "status": "affected",
              "version": "6a5bcd84e886",
              "versionType": "git"
            },
            {
              "lessThan": "c3198822c6cb",
              "status": "affected",
              "version": "6a5bcd84e886",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/skbuff.h",
            "net/ipv4/esp4.c",
            "net/ipv6/esp6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: esp: fix bad handling of pages from page_pool\n\nWhen the skb is reorganized during esp_output (!esp-\u003einline), the pages\ncoming from the original skb fragments are supposed to be released back\nto the system through put_page. But if the skb fragment pages are\noriginating from a page_pool, calling put_page on them will trigger a\npage_pool leak which will eventually result in a crash.\n\nThis leak can be easily observed when using CONFIG_DEBUG_VM and doing\nipsec + gre (non offloaded) forwarding:\n\n  BUG: Bad page state in process ksoftirqd/16  pfn:1451b6\n  page:00000000de2b8d32 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1451b6000 pfn:0x1451b6\n  flags: 0x200000000000000(node=0|zone=2)\n  page_type: 0xffffffff()\n  raw: 0200000000000000 dead000000000040 ffff88810d23c000 0000000000000000\n  raw: 00000001451b6000 0000000000000001 00000000ffffffff 0000000000000000\n  page dumped because: page_pool leak\n  Modules linked in: ip_gre gre mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay zram zsmalloc fuse [last unloaded: mlx5_core]\n  CPU: 16 PID: 96 Comm: ksoftirqd/16 Not tainted 6.8.0-rc4+ #22\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x36/0x50\n   bad_page+0x70/0xf0\n   free_unref_page_prepare+0x27a/0x460\n   free_unref_page+0x38/0x120\n   esp_ssg_unref.isra.0+0x15f/0x200\n   esp_output_tail+0x66d/0x780\n   esp_xmit+0x2c5/0x360\n   validate_xmit_xfrm+0x313/0x370\n   ? validate_xmit_skb+0x1d/0x330\n   validate_xmit_skb_list+0x4c/0x70\n   sch_direct_xmit+0x23e/0x350\n   __dev_queue_xmit+0x337/0xba0\n   ? nf_hook_slow+0x3f/0xd0\n   ip_finish_output2+0x25e/0x580\n   iptunnel_xmit+0x19b/0x240\n   ip_tunnel_xmit+0x5fb/0xb60\n   ipgre_xmit+0x14d/0x280 [ip_gre]\n   dev_hard_start_xmit+0xc3/0x1c0\n   __dev_queue_xmit+0x208/0xba0\n   ? nf_hook_slow+0x3f/0xd0\n   ip_finish_output2+0x1ca/0x580\n   ip_sublist_rcv_finish+0x32/0x40\n   ip_sublist_rcv+0x1b2/0x1f0\n   ? ip_rcv_finish_core.constprop.0+0x460/0x460\n   ip_list_rcv+0x103/0x130\n   __netif_receive_skb_list_core+0x181/0x1e0\n   netif_receive_skb_list_internal+0x1b3/0x2c0\n   napi_gro_receive+0xc8/0x200\n   gro_cell_poll+0x52/0x90\n   __napi_poll+0x25/0x1a0\n   net_rx_action+0x28e/0x300\n   __do_softirq+0xc3/0x276\n   ? sort_range+0x20/0x20\n   run_ksoftirqd+0x1e/0x30\n   smpboot_thread_fn+0xa6/0x130\n   kthread+0xcd/0x100\n   ? kthread_complete_and_exit+0x20/0x20\n   ret_from_fork+0x31/0x50\n   ? kthread_complete_and_exit+0x20/0x20\n   ret_from_fork_asm+0x11/0x20\n   \u003c/TASK\u003e\n\nThe suggested fix is to introduce a new wrapper (skb_page_unref) that\ncovers page refcounting for page_pool pages as well."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:25:47.065Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8291b4eac429c480386669444c6377573f5d8664"
        },
        {
          "url": "https://git.kernel.org/stable/c/1abb20a5f4b02fb3020f88456fc1e6069b3cdc45"
        },
        {
          "url": "https://git.kernel.org/stable/c/f278ff9db67264715d0d50e3e75044f8b78990f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3198822c6cb9fb588e446540485669cc81c5d34"
        }
      ],
      "title": "net: esp: fix bad handling of pages from page_pool",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26953",
    "datePublished": "2024-05-01T05:18:43.199Z",
    "dateReserved": "2024-02-19T14:20:24.200Z",
    "dateUpdated": "2024-09-11T17:33:48.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26953\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T06:15:11.457\",\"lastModified\":\"2024-05-01T13:02:20.750\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: esp: fix bad handling of pages from page_pool\\n\\nWhen the skb is reorganized during esp_output (!esp-\u003einline), the pages\\ncoming from the original skb fragments are supposed to be released back\\nto the system through put_page. But if the skb fragment pages are\\noriginating from a page_pool, calling put_page on them will trigger a\\npage_pool leak which will eventually result in a crash.\\n\\nThis leak can be easily observed when using CONFIG_DEBUG_VM and doing\\nipsec + gre (non offloaded) forwarding:\\n\\n  BUG: Bad page state in process ksoftirqd/16  pfn:1451b6\\n  page:00000000de2b8d32 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1451b6000 pfn:0x1451b6\\n  flags: 0x200000000000000(node=0|zone=2)\\n  page_type: 0xffffffff()\\n  raw: 0200000000000000 dead000000000040 ffff88810d23c000 0000000000000000\\n  raw: 00000001451b6000 0000000000000001 00000000ffffffff 0000000000000000\\n  page dumped because: page_pool leak\\n  Modules linked in: ip_gre gre mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay zram zsmalloc fuse [last unloaded: mlx5_core]\\n  CPU: 16 PID: 96 Comm: ksoftirqd/16 Not tainted 6.8.0-rc4+ #22\\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x36/0x50\\n   bad_page+0x70/0xf0\\n   free_unref_page_prepare+0x27a/0x460\\n   free_unref_page+0x38/0x120\\n   esp_ssg_unref.isra.0+0x15f/0x200\\n   esp_output_tail+0x66d/0x780\\n   esp_xmit+0x2c5/0x360\\n   validate_xmit_xfrm+0x313/0x370\\n   ? validate_xmit_skb+0x1d/0x330\\n   validate_xmit_skb_list+0x4c/0x70\\n   sch_direct_xmit+0x23e/0x350\\n   __dev_queue_xmit+0x337/0xba0\\n   ? nf_hook_slow+0x3f/0xd0\\n   ip_finish_output2+0x25e/0x580\\n   iptunnel_xmit+0x19b/0x240\\n   ip_tunnel_xmit+0x5fb/0xb60\\n   ipgre_xmit+0x14d/0x280 [ip_gre]\\n   dev_hard_start_xmit+0xc3/0x1c0\\n   __dev_queue_xmit+0x208/0xba0\\n   ? nf_hook_slow+0x3f/0xd0\\n   ip_finish_output2+0x1ca/0x580\\n   ip_sublist_rcv_finish+0x32/0x40\\n   ip_sublist_rcv+0x1b2/0x1f0\\n   ? ip_rcv_finish_core.constprop.0+0x460/0x460\\n   ip_list_rcv+0x103/0x130\\n   __netif_receive_skb_list_core+0x181/0x1e0\\n   netif_receive_skb_list_internal+0x1b3/0x2c0\\n   napi_gro_receive+0xc8/0x200\\n   gro_cell_poll+0x52/0x90\\n   __napi_poll+0x25/0x1a0\\n   net_rx_action+0x28e/0x300\\n   __do_softirq+0xc3/0x276\\n   ? sort_range+0x20/0x20\\n   run_ksoftirqd+0x1e/0x30\\n   smpboot_thread_fn+0xa6/0x130\\n   kthread+0xcd/0x100\\n   ? kthread_complete_and_exit+0x20/0x20\\n   ret_from_fork+0x31/0x50\\n   ? kthread_complete_and_exit+0x20/0x20\\n   ret_from_fork_asm+0x11/0x20\\n   \u003c/TASK\u003e\\n\\nThe suggested fix is to introduce a new wrapper (skb_page_unref) that\\ncovers page refcounting for page_pool pages as well.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: esp: corrige el mal manejo de las p\u00e1ginas desde page_pool Cuando el skb se reorganiza durante esp_output (!esp-\u0026gt;inline), se supone que las p\u00e1ginas provenientes de los fragmentos del skb original son devuelto al sistema a trav\u00e9s de put_page. Pero si las p\u00e1ginas del fragmento skb se originan en un page_pool, llamar a put_page en ellas desencadenar\u00e1 una fuga de page_pool que eventualmente resultar\u00e1 en un bloqueo. Esta fuga se puede observar f\u00e1cilmente cuando se usa CONFIG_DEBUG_VM y se realiza el reenv\u00edo ipsec + gre (no descargado): ERROR: Estado de p\u00e1gina incorrecto en el proceso ksoftirqd/16 pfn:1451b6 p\u00e1gina:00000000de2b8d32 refcount:0 mapcount:0 mapeo:0000000000000000 \u00edndice:0x1451b6000 pfn: 0x1451b6 banderas: 0x200000000000000(nodo=0|zona=2) tipo de p\u00e1gina: 0xffffffff() sin formato: 0200000000000000 muerto000000000040 ffff88810d23c000 0000000000000000 sin formato: 0001451b6000 0000000000000001 00000000ffffffff 0000000000000000 p\u00e1gina volcada porque: fuga de page_pool M\u00f3dulos vinculados en: ip_gre gre mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay zram zsmalloc fuse [\u00faltima descarga: mlx5_core] CPU: 16 PID: 96 Comm: ksoftirqd/16 No contaminado 6 .8.0-rc4+ #22 Nombre del hardware: PC est\u00e1ndar QEMU (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 01/04/2014 Seguimiento de llamadas:  dump_stack_lvl+0x36/0x50 bad_page+0x70/0xf0 free_unref_page_prepare+0x27a/0x460 free_unref_page+0x38/0x120 esp_ssg_unref.isra.0+0x15f/0x200 esp_output_tail+0x66d/0x780 esp_xmit+0x2c5/0x360 validar_xmit_xfrm+0x313/0x370 ? validar_xmit_skb+0x1d/0x330 validar_xmit_skb_list+0x4c/0x70 sch_direct_xmit+0x23e/0x350 __dev_queue_xmit+0x337/0xba0 ? nf_hook_slow+0x3f/0xd0 ip_finish_output2+0x25e/0x580 iptunnel_xmit+0x19b/0x240 ip_tunnel_xmit+0x5fb/0xb60 ipgre_xmit+0x14d/0x280 [ip_gre] dev_hard_start_xmit+0xc3/0x1c0 __dev_queue_xmit+0x208/0xba0? nf_hook_slow+0x3f/0xd0 ip_finish_output2+0x1ca/0x580 ip_sublist_rcv_finish+0x32/0x40 ip_sublist_rcv+0x1b2/0x1f0 ? ip_rcv_finish_core.constprop.0+0x460/0x460 ip_list_rcv+0x103/0x130 __netif_receive_skb_list_core+0x181/0x1e0 netif_receive_skb_list_internal+0x1b3/0x2c0 napi_gro_receive+0xc8/0x200 encuesta+0x52/0x90 __napi_poll+0x25/0x1a0 net_rx_action+0x28e/0x300 __do_softirq+0xc3/0x276 ? sort_range+0x20/0x20 run_ksoftirqd+0x1e/0x30 smpboot_thread_fn+0xa6/0x130 kthread+0xcd/0x100 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x31/0x50 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork_asm+0x11/0x20  La soluci\u00f3n sugerida es introducir un nuevo contenedor (skb_page_unref) que cubra tambi\u00e9n el recuento de p\u00e1ginas para las p\u00e1ginas page_pool.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1abb20a5f4b02fb3020f88456fc1e6069b3cdc45\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8291b4eac429c480386669444c6377573f5d8664\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c3198822c6cb9fb588e446540485669cc81c5d34\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f278ff9db67264715d0d50e3e75044f8b78990f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.