cve-2024-57795
Vulnerability from cvelistv5
Published
2025-01-15 13:10
Modified
2025-02-13 14:04
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Remove the direct link to net_device The similar patch in siw is in the link: https://git.kernel.org/rdma/rdma/c/16b87037b48889 This problem also occurred in RXE. The following analyze this problem. In the following Call Traces: " BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 net/core/dev.c:8782 Read of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295 CPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: infiniband ib_cache_event_task Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 dev_get_flags+0x188/0x1d0 net/core/dev.c:8782 rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60 __ib_query_port drivers/infiniband/core/device.c:2111 [inline] ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143 ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494 ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> " 1). In the link [1], " infiniband syz2: set down " This means that on 839.350575, the event ib_cache_event_task was sent andi queued in ib_wq. 2). In the link [1], " team0 (unregistering): Port device team_slave_0 removed " It indicates that before 843.251853, the net device should be freed. 3). In the link [1], " BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 " This means that on 850.559070, this slab-use-after-free problem occurred. In all, on 839.350575, the event ib_cache_event_task was sent and queued in ib_wq, before 843.251853, the net device veth was freed. on 850.559070, this event was executed, and the mentioned freed net device was called. Thus, the above call trace occurred. [1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2ac5415022d16d63d912a39a06f32f1f51140261
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9f6f54e6a6863131442b40e14d1792b090c7ce21
Impacted products
Vendor Product Version
Linux Linux Version: 8700e3e7c4857d28ebaa824509934556da0b3e76
Version: 8700e3e7c4857d28ebaa824509934556da0b3e76
 Create a notification for this product.
   Linux Linux Version: 4.8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-57795",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-13T13:56:40.628550Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-13T14:04:27.443Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe.c",
            "drivers/infiniband/sw/rxe/rxe.h",
            "drivers/infiniband/sw/rxe/rxe_mcast.c",
            "drivers/infiniband/sw/rxe/rxe_net.c",
            "drivers/infiniband/sw/rxe/rxe_verbs.c",
            "drivers/infiniband/sw/rxe/rxe_verbs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9f6f54e6a6863131442b40e14d1792b090c7ce21",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "2ac5415022d16d63d912a39a06f32f1f51140261",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe.c",
            "drivers/infiniband/sw/rxe/rxe.h",
            "drivers/infiniband/sw/rxe/rxe_mcast.c",
            "drivers/infiniband/sw/rxe/rxe_net.c",
            "drivers/infiniband/sw/rxe/rxe_verbs.c",
            "drivers/infiniband/sw/rxe/rxe_verbs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Remove the direct link to net_device\n\nThe similar patch in siw is in the link:\nhttps://git.kernel.org/rdma/rdma/c/16b87037b48889\n\nThis problem also occurred in RXE. The following analyze this problem.\nIn the following Call Traces:\n\"\nBUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 net/core/dev.c:8782\nRead of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295\n\nCPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted\n6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0\nHardware name: Google Compute Engine/Google Compute Engine,\nBIOS Google 09/13/2024\nWorkqueue: infiniband ib_cache_event_task\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n dev_get_flags+0x188/0x1d0 net/core/dev.c:8782\n rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60\n __ib_query_port drivers/infiniband/core/device.c:2111 [inline]\n ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143\n ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494\n ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f2/0x390 kernel/kthread.c:389\n ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n \u003c/TASK\u003e\n\"\n\n1). In the link [1],\n\n\"\n infiniband syz2: set down\n\"\n\nThis means that on 839.350575, the event ib_cache_event_task was sent andi\nqueued in ib_wq.\n\n2). In the link [1],\n\n\"\n team0 (unregistering): Port device team_slave_0 removed\n\"\n\nIt indicates that before 843.251853, the net device should be freed.\n\n3). In the link [1],\n\n\"\n BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0\n\"\n\nThis means that on 850.559070, this slab-use-after-free problem occurred.\n\nIn all, on 839.350575, the event ib_cache_event_task was sent and queued\nin ib_wq,\n\nbefore 843.251853, the net device veth was freed.\n\non 850.559070, this event was executed, and the mentioned freed net device\nwas called. Thus, the above call trace occurred.\n\n[1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-20T06:28:16.103Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9f6f54e6a6863131442b40e14d1792b090c7ce21"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ac5415022d16d63d912a39a06f32f1f51140261"
        }
      ],
      "title": "RDMA/rxe: Remove the direct link to net_device",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57795",
    "datePublished": "2025-01-15T13:10:23.880Z",
    "dateReserved": "2025-01-15T13:08:59.657Z",
    "dateUpdated": "2025-02-13T14:04:27.443Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-57795\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-15T13:15:11.563\",\"lastModified\":\"2025-02-13T14:16:17.430\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/rxe: Remove the direct link to net_device\\n\\nThe similar patch in siw is in the link:\\nhttps://git.kernel.org/rdma/rdma/c/16b87037b48889\\n\\nThis problem also occurred in RXE. The following analyze this problem.\\nIn the following Call Traces:\\n\\\"\\nBUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 net/core/dev.c:8782\\nRead of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295\\n\\nCPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted\\n6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0\\nHardware name: Google Compute Engine/Google Compute Engine,\\nBIOS Google 09/13/2024\\nWorkqueue: infiniband ib_cache_event_task\\nCall Trace:\\n \u003cTASK\u003e\\n __dump_stack lib/dump_stack.c:94 [inline]\\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\\n print_address_description mm/kasan/report.c:377 [inline]\\n print_report+0x169/0x550 mm/kasan/report.c:488\\n kasan_report+0x143/0x180 mm/kasan/report.c:601\\n dev_get_flags+0x188/0x1d0 net/core/dev.c:8782\\n rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60\\n __ib_query_port drivers/infiniband/core/device.c:2111 [inline]\\n ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143\\n ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494\\n ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568\\n process_one_work kernel/workqueue.c:3229 [inline]\\n process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310\\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\\n kthread+0x2f2/0x390 kernel/kthread.c:389\\n ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147\\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\\n \u003c/TASK\u003e\\n\\\"\\n\\n1). In the link [1],\\n\\n\\\"\\n infiniband syz2: set down\\n\\\"\\n\\nThis means that on 839.350575, the event ib_cache_event_task was sent andi\\nqueued in ib_wq.\\n\\n2). In the link [1],\\n\\n\\\"\\n team0 (unregistering): Port device team_slave_0 removed\\n\\\"\\n\\nIt indicates that before 843.251853, the net device should be freed.\\n\\n3). In the link [1],\\n\\n\\\"\\n BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0\\n\\\"\\n\\nThis means that on 850.559070, this slab-use-after-free problem occurred.\\n\\nIn all, on 839.350575, the event ib_cache_event_task was sent and queued\\nin ib_wq,\\n\\nbefore 843.251853, the net device veth was freed.\\n\\non 850.559070, this event was executed, and the mentioned freed net device\\nwas called. Thus, the above call trace occurred.\\n\\n[1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: RDMA/rxe: eliminar el enlace directo a net_device El parche similar en siw se encuentra en el enlace: https://git.kernel.org/rdma/rdma/c/16b87037b48889 Este problema tambi\u00e9n se produjo en RXE. A continuaci\u00f3n se analiza este problema. En los siguientes seguimientos de llamadas: \\\"ERROR: KASAN: slab-use-after-free en dev_get_flags+0x188/0x1d0 net/core/dev.c:8782 Lectura de tama\u00f1o 4 en la direcci\u00f3n ffff8880554640b0 por la tarea kworker/1:4/5295 CPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 No contaminado 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 Nombre del hardware: Google Compute Engine/Google Compute Engine, BIOS Google 13/09/2024 Cola de trabajo: infiniband ib_cache_event_task Seguimiento de llamadas:  __dump_stack lib/dump_stack.c:94 [en l\u00ednea] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 imprimir_direcci\u00f3n_descripci\u00f3n mm/kasan/report.c:377 [en l\u00ednea] imprimir_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 dev_get_flags+0x188/0x1d0 net/core/dev.c:8782 rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60 __ib_query_port drivers/infiniband/core/device.c:2111 [en l\u00ednea] ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143 ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494 ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568 process_one_work kernel/workqueue.c:3229 [en l\u00ednea] process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244  \\\" 1). En el enlace [1], \\\" infiniband syz2: set down \\\" Esto significa que en 839.350575, se envi\u00f3 el evento ib_cache_event_task y se puso en cola en ib_wq. 2). En el enlace [1], \\\" team0 (unregistering): Port device team_slave_0 removed \\\" Esto indica que antes de 843.251853, se debe liberar el dispositivo de red. 3). En el enlace [1], \\\" BUG: KASAN: slab-use-after-free en dev_get_flags+0x188/0x1d0 \\\" Esto significa que en 850.559070, ocurri\u00f3 este problema de slab-use-after-free. En total, el 839.350575, se envi\u00f3 el evento ib_cache_event_task y se puso en cola en ib_wq, antes del 843.251853, se liber\u00f3 el dispositivo de red veth. El 850.559070, se ejecut\u00f3 este evento y se llam\u00f3 al dispositivo de red liberado mencionado. Por lo tanto, se produjo el seguimiento de la llamada anterior. [1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2ac5415022d16d63d912a39a06f32f1f51140261\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9f6f54e6a6863131442b40e14d1792b090c7ce21\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-57795\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-13T13:56:40.628550Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-13T13:56:41.933Z\"}}], \"cna\": {\"title\": \"RDMA/rxe: Remove the direct link to net_device\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8700e3e7c4857d28ebaa824509934556da0b3e76\", \"lessThan\": \"9f6f54e6a6863131442b40e14d1792b090c7ce21\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8700e3e7c4857d28ebaa824509934556da0b3e76\", \"lessThan\": \"2ac5415022d16d63d912a39a06f32f1f51140261\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/infiniband/sw/rxe/rxe.c\", \"drivers/infiniband/sw/rxe/rxe.h\", \"drivers/infiniband/sw/rxe/rxe_mcast.c\", \"drivers/infiniband/sw/rxe/rxe_net.c\", \"drivers/infiniband/sw/rxe/rxe_verbs.c\", \"drivers/infiniband/sw/rxe/rxe_verbs.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/infiniband/sw/rxe/rxe.c\", \"drivers/infiniband/sw/rxe/rxe.h\", \"drivers/infiniband/sw/rxe/rxe_mcast.c\", \"drivers/infiniband/sw/rxe/rxe_net.c\", \"drivers/infiniband/sw/rxe/rxe_verbs.c\", \"drivers/infiniband/sw/rxe/rxe_verbs.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9f6f54e6a6863131442b40e14d1792b090c7ce21\"}, {\"url\": \"https://git.kernel.org/stable/c/2ac5415022d16d63d912a39a06f32f1f51140261\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/rxe: Remove the direct link to net_device\\n\\nThe similar patch in siw is in the link:\\nhttps://git.kernel.org/rdma/rdma/c/16b87037b48889\\n\\nThis problem also occurred in RXE. The following analyze this problem.\\nIn the following Call Traces:\\n\\\"\\nBUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 net/core/dev.c:8782\\nRead of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295\\n\\nCPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted\\n6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0\\nHardware name: Google Compute Engine/Google Compute Engine,\\nBIOS Google 09/13/2024\\nWorkqueue: infiniband ib_cache_event_task\\nCall Trace:\\n \u003cTASK\u003e\\n __dump_stack lib/dump_stack.c:94 [inline]\\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\\n print_address_description mm/kasan/report.c:377 [inline]\\n print_report+0x169/0x550 mm/kasan/report.c:488\\n kasan_report+0x143/0x180 mm/kasan/report.c:601\\n dev_get_flags+0x188/0x1d0 net/core/dev.c:8782\\n rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60\\n __ib_query_port drivers/infiniband/core/device.c:2111 [inline]\\n ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143\\n ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494\\n ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568\\n process_one_work kernel/workqueue.c:3229 [inline]\\n process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310\\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\\n kthread+0x2f2/0x390 kernel/kthread.c:389\\n ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147\\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\\n \u003c/TASK\u003e\\n\\\"\\n\\n1). In the link [1],\\n\\n\\\"\\n infiniband syz2: set down\\n\\\"\\n\\nThis means that on 839.350575, the event ib_cache_event_task was sent andi\\nqueued in ib_wq.\\n\\n2). In the link [1],\\n\\n\\\"\\n team0 (unregistering): Port device team_slave_0 removed\\n\\\"\\n\\nIt indicates that before 843.251853, the net device should be freed.\\n\\n3). In the link [1],\\n\\n\\\"\\n BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0\\n\\\"\\n\\nThis means that on 850.559070, this slab-use-after-free problem occurred.\\n\\nIn all, on 839.350575, the event ib_cache_event_task was sent and queued\\nin ib_wq,\\n\\nbefore 843.251853, the net device veth was freed.\\n\\non 850.559070, this event was executed, and the mentioned freed net device\\nwas called. Thus, the above call trace occurred.\\n\\n[1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-01-20T06:28:16.103Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-57795\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-13T14:04:27.443Z\", \"dateReserved\": \"2025-01-15T13:08:59.657Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-15T13:10:23.880Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.