cve-2024-35959
Vulnerability from cvelistv5
Published
2024-05-20 09:41
Modified
2024-09-11 17:33
Severity
Summary
net/mlx5e: Fix mlx5e_priv_init() cleanup flow
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6bd77865fda662913dcb5722a66a773840370aa7
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ad26f26abd353113dea4e8d5ebadccdab9b61e76
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ecb829459a841198e142f72fadab56424ae96519
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f9ac93b6f3de34aa0bb983b9be4f69ca50fc70f3
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:49.131Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad26f26abd353113dea4e8d5ebadccdab9b61e76"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f9ac93b6f3de34aa0bb983b9be4f69ca50fc70f3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6bd77865fda662913dcb5722a66a773840370aa7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ecb829459a841198e142f72fadab56424ae96519"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35959",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:40:38.972541Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:14.315Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en/selq.c",
            "drivers/net/ethernet/mellanox/mlx5/core/en_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad26f26abd35",
              "status": "affected",
              "version": "8bf30be75069",
              "versionType": "git"
            },
            {
              "lessThan": "f9ac93b6f3de",
              "status": "affected",
              "version": "8bf30be75069",
              "versionType": "git"
            },
            {
              "lessThan": "6bd77865fda6",
              "status": "affected",
              "version": "8bf30be75069",
              "versionType": "git"
            },
            {
              "lessThan": "ecb829459a84",
              "status": "affected",
              "version": "8bf30be75069",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en/selq.c",
            "drivers/net/ethernet/mellanox/mlx5/core/en_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.87",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.28",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.7",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix mlx5e_priv_init() cleanup flow\n\nWhen mlx5e_priv_init() fails, the cleanup flow calls mlx5e_selq_cleanup which\ncalls mlx5e_selq_apply() that assures that the `priv-\u003estate_lock` is held using\nlockdep_is_held().\n\nAcquire the state_lock in mlx5e_selq_cleanup().\n\nKernel log:\n=============================\nWARNING: suspicious RCU usage\n6.8.0-rc3_net_next_841a9b5 #1 Not tainted\n-----------------------------\ndrivers/net/ethernet/mellanox/mlx5/core/en/selq.c:124 suspicious rcu_dereference_protected() usage!\n\nother info that might help us debug this:\n\nrcu_scheduler_active = 2, debug_locks = 1\n2 locks held by systemd-modules/293:\n #0: ffffffffa05067b0 (devices_rwsem){++++}-{3:3}, at: ib_register_client+0x109/0x1b0 [ib_core]\n #1: ffff8881096c65c0 (\u0026device-\u003eclient_data_rwsem){++++}-{3:3}, at: add_client_context+0x104/0x1c0 [ib_core]\n\nstack backtrace:\nCPU: 4 PID: 293 Comm: systemd-modules Not tainted 6.8.0-rc3_net_next_841a9b5 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x8a/0xa0\n lockdep_rcu_suspicious+0x154/0x1a0\n mlx5e_selq_apply+0x94/0xa0 [mlx5_core]\n mlx5e_selq_cleanup+0x3a/0x60 [mlx5_core]\n mlx5e_priv_init+0x2be/0x2f0 [mlx5_core]\n mlx5_rdma_setup_rn+0x7c/0x1a0 [mlx5_core]\n rdma_init_netdev+0x4e/0x80 [ib_core]\n ? mlx5_rdma_netdev_free+0x70/0x70 [mlx5_core]\n ipoib_intf_init+0x64/0x550 [ib_ipoib]\n ipoib_intf_alloc+0x4e/0xc0 [ib_ipoib]\n ipoib_add_one+0xb0/0x360 [ib_ipoib]\n add_client_context+0x112/0x1c0 [ib_core]\n ib_register_client+0x166/0x1b0 [ib_core]\n ? 0xffffffffa0573000\n ipoib_init_module+0xeb/0x1a0 [ib_ipoib]\n do_one_initcall+0x61/0x250\n do_init_module+0x8a/0x270\n init_module_from_file+0x8b/0xd0\n idempotent_init_module+0x17d/0x230\n __x64_sys_finit_module+0x61/0xb0\n do_syscall_64+0x71/0x140\n entry_SYSCALL_64_after_hwframe+0x46/0x4e\n \u003c/TASK\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:31:59.270Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad26f26abd353113dea4e8d5ebadccdab9b61e76"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9ac93b6f3de34aa0bb983b9be4f69ca50fc70f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bd77865fda662913dcb5722a66a773840370aa7"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecb829459a841198e142f72fadab56424ae96519"
        }
      ],
      "title": "net/mlx5e: Fix mlx5e_priv_init() cleanup flow",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35959",
    "datePublished": "2024-05-20T09:41:51.244Z",
    "dateReserved": "2024-05-17T13:50:33.137Z",
    "dateUpdated": "2024-09-11T17:33:14.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35959\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-20T10:15:11.123\",\"lastModified\":\"2024-05-20T13:00:04.957\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: Fix mlx5e_priv_init() cleanup flow\\n\\nWhen mlx5e_priv_init() fails, the cleanup flow calls mlx5e_selq_cleanup which\\ncalls mlx5e_selq_apply() that assures that the `priv-\u003estate_lock` is held using\\nlockdep_is_held().\\n\\nAcquire the state_lock in mlx5e_selq_cleanup().\\n\\nKernel log:\\n=============================\\nWARNING: suspicious RCU usage\\n6.8.0-rc3_net_next_841a9b5 #1 Not tainted\\n-----------------------------\\ndrivers/net/ethernet/mellanox/mlx5/core/en/selq.c:124 suspicious rcu_dereference_protected() usage!\\n\\nother info that might help us debug this:\\n\\nrcu_scheduler_active = 2, debug_locks = 1\\n2 locks held by systemd-modules/293:\\n #0: ffffffffa05067b0 (devices_rwsem){++++}-{3:3}, at: ib_register_client+0x109/0x1b0 [ib_core]\\n #1: ffff8881096c65c0 (\u0026device-\u003eclient_data_rwsem){++++}-{3:3}, at: add_client_context+0x104/0x1c0 [ib_core]\\n\\nstack backtrace:\\nCPU: 4 PID: 293 Comm: systemd-modules Not tainted 6.8.0-rc3_net_next_841a9b5 #1\\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x8a/0xa0\\n lockdep_rcu_suspicious+0x154/0x1a0\\n mlx5e_selq_apply+0x94/0xa0 [mlx5_core]\\n mlx5e_selq_cleanup+0x3a/0x60 [mlx5_core]\\n mlx5e_priv_init+0x2be/0x2f0 [mlx5_core]\\n mlx5_rdma_setup_rn+0x7c/0x1a0 [mlx5_core]\\n rdma_init_netdev+0x4e/0x80 [ib_core]\\n ? mlx5_rdma_netdev_free+0x70/0x70 [mlx5_core]\\n ipoib_intf_init+0x64/0x550 [ib_ipoib]\\n ipoib_intf_alloc+0x4e/0xc0 [ib_ipoib]\\n ipoib_add_one+0xb0/0x360 [ib_ipoib]\\n add_client_context+0x112/0x1c0 [ib_core]\\n ib_register_client+0x166/0x1b0 [ib_core]\\n ? 0xffffffffa0573000\\n ipoib_init_module+0xeb/0x1a0 [ib_ipoib]\\n do_one_initcall+0x61/0x250\\n do_init_module+0x8a/0x270\\n init_module_from_file+0x8b/0xd0\\n idempotent_init_module+0x17d/0x230\\n __x64_sys_finit_module+0x61/0xb0\\n do_syscall_64+0x71/0x140\\n entry_SYSCALL_64_after_hwframe+0x46/0x4e\\n \u003c/TASK\u003e\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: net/mlx5e: corrige el flujo de limpieza de mlx5e_priv_init(). Cuando falla mlx5e_priv_init(), el flujo de limpieza llama a mlx5e_selq_cleanup, que llama a mlx5e_selq_apply() y garantiza que se mantenga `priv-\u0026gt;state_lock`. usando lockdep_is_held(). Adquiera state_lock en mlx5e_selq_cleanup(). Registro del kernel: ============================= ADVERTENCIA: uso sospechoso de RCU 6.8.0-rc3_net_next_841a9b5 #1 No contaminado ---- ------------------------- drivers/net/ethernet/mellanox/mlx5/core/en/selq.c:124 \u00a1Uso sospechoso de rcu_dereference_protected()! otra informaci\u00f3n que podr\u00eda ayudarnos a depurar esto: rcu_scheduler_active = 2, debug_locks = 1 2 bloqueos mantenidos por systemd-modules/293: #0: ffffffffa05067b0 (devices_rwsem){++++}-{3:3}, en: ib_register_client+ 0x109/0x1b0 [ib_core] #1: ffff8881096c65c0 (\u0026amp;device-\u0026gt;client_data_rwsem){++++}-{3:3}, en: add_client_context+0x104/0x1c0 [ib_core] seguimiento de pila: CPU: 4 PID: 293 Comunicaciones: systemd-modules No est\u00e1 contaminado 6.8.0-rc3_net_next_841a9b5 #1 Nombre del hardware: PC est\u00e1ndar QEMU (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 01/04/2014 Seguimiento de llamadas:  dump_stack_lvl+0x8a/0xa0 lockdep_rcu_suspicious+0x154/0x1a0 mlx5e_selq_apply+0x94/0xa0 [mlx5_core] mlx5e_selq_cleanup+0x3a/0x60 [mlx5_core] mlx5e_priv_init+0x2be/0x2f0 [mlx5_ n\u00facleo] mlx5_rdma_setup_rn+0x7c/0x1a0 [mlx5_core] rdma_init_netdev+0x4e/0x80 [ib_core] ? mlx5_rdma_netdev_free+0x70/0x70 [mlx5_core] ipoib_intf_init+0x64/0x550 [ib_ipoib] ipoib_intf_alloc+0x4e/0xc0 [ib_ipoib] ipoib_add_one+0xb0/0x360 [ib_ipoib] add_client_context+0x112/0 x1c0 [ib_core] ib_register_client+0x166/0x1b0 [ib_core]? 0xffffffffa0573000 ipoib_init_module+0xeb/0x1a0 [ib_ipoib] do_one_initcall+0x61/0x250 do_init_module+0x8a/0x270 init_module_from_file+0x8b/0xd0 idempotent_init_module+0x17d/0x230 sys_finit_module+0x61/0xb0 do_syscall_64+0x71/0x140 Entry_SYSCALL_64_after_hwframe+0x46/0x4e \"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6bd77865fda662913dcb5722a66a773840370aa7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ad26f26abd353113dea4e8d5ebadccdab9b61e76\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ecb829459a841198e142f72fadab56424ae96519\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f9ac93b6f3de34aa0bb983b9be4f69ca50fc70f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.