cve-2024-27063
Vulnerability from cvelistv5
Published
2024-05-01 13:00
Modified
2024-09-11 17:32
Severity
Summary
leds: trigger: netdev: Fix kernel panic on interface rename trig notify
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/10f2af1af8ab8a7064f193446abd5579d3def7e3
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3f360227cb46edb2cd2494128e1e06ed5768a62e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/415798bc07dd1c1ae3a656aa026580816e0b9fe8
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/acd025c7a7d151261533016a6ca2d38f2de04e87
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.939Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/10f2af1af8ab8a7064f193446abd5579d3def7e3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/acd025c7a7d151261533016a6ca2d38f2de04e87"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3f360227cb46edb2cd2494128e1e06ed5768a62e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/415798bc07dd1c1ae3a656aa026580816e0b9fe8"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27063",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:44:01.893561Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:32:55.311Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/leds/trigger/ledtrig-netdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10f2af1af8ab",
              "status": "affected",
              "version": "d5e01266e7f5",
              "versionType": "git"
            },
            {
              "lessThan": "acd025c7a7d1",
              "status": "affected",
              "version": "d5e01266e7f5",
              "versionType": "git"
            },
            {
              "lessThan": "3f360227cb46",
              "status": "affected",
              "version": "d5e01266e7f5",
              "versionType": "git"
            },
            {
              "lessThan": "415798bc07dd",
              "status": "affected",
              "version": "d5e01266e7f5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/leds/trigger/ledtrig-netdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nleds: trigger: netdev: Fix kernel panic on interface rename trig notify\n\nCommit d5e01266e7f5 (\"leds: trigger: netdev: add additional specific link\nspeed mode\") in the various changes, reworked the way to set the LINKUP\nmode in commit cee4bd16c319 (\"leds: trigger: netdev: Recheck\nNETDEV_LED_MODE_LINKUP on dev rename\") and moved it to a generic function.\n\nThis changed the logic where, in the previous implementation the dev\nfrom the trigger event was used to check if the carrier was ok, but in\nthe new implementation with the generic function, the dev in\ntrigger_data is used instead.\n\nThis is problematic and cause a possible kernel panic due to the fact\nthat the dev in the trigger_data still reference the old one as the\nnew one (passed from the trigger event) still has to be hold and saved\nin the trigger_data struct (done in the NETDEV_REGISTER case).\n\nOn calling of get_device_state(), an invalid net_dev is used and this\ncause a kernel panic.\n\nTo handle this correctly, move the call to get_device_state() after the\nnew net_dev is correctly set in trigger_data (in the NETDEV_REGISTER\ncase) and correctly parse the new dev."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:27:53.600Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/10f2af1af8ab8a7064f193446abd5579d3def7e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/acd025c7a7d151261533016a6ca2d38f2de04e87"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f360227cb46edb2cd2494128e1e06ed5768a62e"
        },
        {
          "url": "https://git.kernel.org/stable/c/415798bc07dd1c1ae3a656aa026580816e0b9fe8"
        }
      ],
      "title": "leds: trigger: netdev: Fix kernel panic on interface rename trig notify",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27063",
    "datePublished": "2024-05-01T13:00:24.506Z",
    "dateReserved": "2024-02-19T14:20:24.215Z",
    "dateUpdated": "2024-09-11T17:32:55.311Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27063\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T13:15:50.707\",\"lastModified\":\"2024-05-01T19:50:25.633\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nleds: trigger: netdev: Fix kernel panic on interface rename trig notify\\n\\nCommit d5e01266e7f5 (\\\"leds: trigger: netdev: add additional specific link\\nspeed mode\\\") in the various changes, reworked the way to set the LINKUP\\nmode in commit cee4bd16c319 (\\\"leds: trigger: netdev: Recheck\\nNETDEV_LED_MODE_LINKUP on dev rename\\\") and moved it to a generic function.\\n\\nThis changed the logic where, in the previous implementation the dev\\nfrom the trigger event was used to check if the carrier was ok, but in\\nthe new implementation with the generic function, the dev in\\ntrigger_data is used instead.\\n\\nThis is problematic and cause a possible kernel panic due to the fact\\nthat the dev in the trigger_data still reference the old one as the\\nnew one (passed from the trigger event) still has to be hold and saved\\nin the trigger_data struct (done in the NETDEV_REGISTER case).\\n\\nOn calling of get_device_state(), an invalid net_dev is used and this\\ncause a kernel panic.\\n\\nTo handle this correctly, move the call to get_device_state() after the\\nnew net_dev is correctly set in trigger_data (in the NETDEV_REGISTER\\ncase) and correctly parse the new dev.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: leds: trigger: netdev: corrige el p\u00e1nico del kernel al cambiar el nombre de la interfaz, notifica el trigono. Commit d5e01266e7f5 (\\\"leds: trigger: netdev: agrega un modo de velocidad de enlace espec\u00edfico adicional\\\") en los diversos cambios, reelaborados la forma de configurar el modo LINKUP en el commit cee4bd16c319 (\\\"leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename\\\") y lo mov\u00ed a una funci\u00f3n gen\u00e9rica. Esto cambi\u00f3 la l\u00f3gica donde, en la implementaci\u00f3n anterior, se usaba el desarrollo del evento desencadenante para verificar si el operador estaba bien, pero en la nueva implementaci\u00f3n con la funci\u00f3n gen\u00e9rica, se usa el desarrollo en trigger_data. Esto es problem\u00e1tico y causa un posible p\u00e1nico en el kernel debido al hecho de que el desarrollador en trigger_data a\u00fan hace referencia al anterior, ya que el nuevo (pasado desde el evento desencadenante) a\u00fan debe retenerse y guardarse en la estructura trigger_data (hecho en el caso NETDEV_REGISTER). Al llamar a get_device_state(), se utiliza un net_dev no v\u00e1lido y esto provoca un p\u00e1nico en el kernel. Para manejar esto correctamente, mueva la llamada a get_device_state() despu\u00e9s de que el nuevo net_dev est\u00e9 configurado correctamente en trigger_data (en el caso NETDEV_REGISTER) y analice correctamente el nuevo dev.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/10f2af1af8ab8a7064f193446abd5579d3def7e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3f360227cb46edb2cd2494128e1e06ed5768a62e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/415798bc07dd1c1ae3a656aa026580816e0b9fe8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/acd025c7a7d151261533016a6ca2d38f2de04e87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.