fkie_cve-2022-48842
Vulnerability from fkie_nvd
Published
2024-07-16 13:15
Modified
2024-11-21 07:34
Severity ?
4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ice: Fix race condition during interface enslave Commit 5dbbbd01cbba83 ("ice: Avoid RTNL lock when re-creating auxiliary device") changes a process of re-creation of aux device so ice_plug_aux_dev() is called from ice_service_task() context. This unfortunately opens a race window that can result in dead-lock when interface has left LAG and immediately enters LAG again. Reproducer: ``` #!/bin/sh ip link add lag0 type bond mode 1 miimon 100 ip link set lag0 for n in {1..10}; do echo Cycle: $n ip link set ens7f0 master lag0 sleep 1 ip link set ens7f0 nomaster done ``` This results in: [20976.208697] Workqueue: ice ice_service_task [ice] [20976.213422] Call Trace: [20976.215871] __schedule+0x2d1/0x830 [20976.219364] schedule+0x35/0xa0 [20976.222510] schedule_preempt_disabled+0xa/0x10 [20976.227043] __mutex_lock.isra.7+0x310/0x420 [20976.235071] enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core] [20976.251215] ib_enum_roce_netdev+0xa4/0xe0 [ib_core] [20976.256192] ib_cache_setup_one+0x33/0xa0 [ib_core] [20976.261079] ib_register_device+0x40d/0x580 [ib_core] [20976.266139] irdma_ib_register_device+0x129/0x250 [irdma] [20976.281409] irdma_probe+0x2c1/0x360 [irdma] [20976.285691] auxiliary_bus_probe+0x45/0x70 [20976.289790] really_probe+0x1f2/0x480 [20976.298509] driver_probe_device+0x49/0xc0 [20976.302609] bus_for_each_drv+0x79/0xc0 [20976.306448] __device_attach+0xdc/0x160 [20976.310286] bus_probe_device+0x9d/0xb0 [20976.314128] device_add+0x43c/0x890 [20976.321287] __auxiliary_device_add+0x43/0x60 [20976.325644] ice_plug_aux_dev+0xb2/0x100 [ice] [20976.330109] ice_service_task+0xd0c/0xed0 [ice] [20976.342591] process_one_work+0x1a7/0x360 [20976.350536] worker_thread+0x30/0x390 [20976.358128] kthread+0x10a/0x120 [20976.365547] ret_from_fork+0x1f/0x40 ... [20976.438030] task:ip state:D stack: 0 pid:213658 ppid:213627 flags:0x00004084 [20976.446469] Call Trace: [20976.448921] __schedule+0x2d1/0x830 [20976.452414] schedule+0x35/0xa0 [20976.455559] schedule_preempt_disabled+0xa/0x10 [20976.460090] __mutex_lock.isra.7+0x310/0x420 [20976.464364] device_del+0x36/0x3c0 [20976.467772] ice_unplug_aux_dev+0x1a/0x40 [ice] [20976.472313] ice_lag_event_handler+0x2a2/0x520 [ice] [20976.477288] notifier_call_chain+0x47/0x70 [20976.481386] __netdev_upper_dev_link+0x18b/0x280 [20976.489845] bond_enslave+0xe05/0x1790 [bonding] [20976.494475] do_setlink+0x336/0xf50 [20976.502517] __rtnl_newlink+0x529/0x8b0 [20976.543441] rtnl_newlink+0x43/0x60 [20976.546934] rtnetlink_rcv_msg+0x2b1/0x360 [20976.559238] netlink_rcv_skb+0x4c/0x120 [20976.563079] netlink_unicast+0x196/0x230 [20976.567005] netlink_sendmsg+0x204/0x3d0 [20976.570930] sock_sendmsg+0x4c/0x50 [20976.574423] ____sys_sendmsg+0x1eb/0x250 [20976.586807] ___sys_sendmsg+0x7c/0xc0 [20976.606353] __sys_sendmsg+0x57/0xa0 [20976.609930] do_syscall_64+0x5b/0x1a0 [20976.613598] entry_SYSCALL_64_after_hwframe+0x65/0xca 1. Command 'ip link ... set nomaster' causes that ice_plug_aux_dev() is called from ice_service_task() context, aux device is created and associated device->lock is taken. 2. Command 'ip link ... set master...' calls ice's notifier under RTNL lock and that notifier calls ice_unplug_aux_dev(). That function tries to take aux device->lock but this is already taken by ice_plug_aux_dev() in step 1 3. Later ice_plug_aux_dev() tries to take RTNL lock but this is already taken in step 2 4. Dead-lock The patch fixes this issue by following changes: - Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev() call in ice_service_task() - The bit is checked in ice_clear_rdma_cap() and only if it is not set then ice_unplug_aux_dev() is called. If it is set (in other words plugging of aux device was requested and ice_plug_aux_dev() is potentially running) then the function only clears the ---truncated---
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbcMailing List, Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49efMailing List, Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dcMailing List, Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbcMailing List, Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49efMailing List, Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dcMailing List, Patch
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel *
linux linux_kernel 5.17
linux linux_kernel 5.17
linux linux_kernel 5.17
linux linux_kernel 5.17
linux linux_kernel 5.17
linux linux_kernel 5.17
linux linux_kernel 5.17
linux linux_kernel 5.17


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "B4DCE220-813A-4393-8BEF-C705DCD12175",
                     versionEndExcluding: "5.15.30",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "EDF25425-C006-411E-B842-0F12075B8C13",
                     versionEndExcluding: "5.16.16",
                     versionStartIncluding: "5.16",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*",
                     matchCriteriaId: "7BD5F8D9-54FA-4CB0-B4F0-CB0471FDDB2D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*",
                     matchCriteriaId: "E6E34B23-78B4-4516-9BD8-61B33F4AC49A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*",
                     matchCriteriaId: "C030FA3D-03F4-4FB9-9DBF-D08E5CAC51AA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:*",
                     matchCriteriaId: "B2D2677C-5389-4AE9-869D-0F881E80D923",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.17:rc5:*:*:*:*:*:*",
                     matchCriteriaId: "EFA3917C-C322-4D92-912D-ECE45B2E7416",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.17:rc6:*:*:*:*:*:*",
                     matchCriteriaId: "BED18363-5ABC-4639-8BBA-68E771E5BB3F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.17:rc7:*:*:*:*:*:*",
                     matchCriteriaId: "7F635F96-FA0A-4769-ADE8-232B3AC9116D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:5.17:rc8:*:*:*:*:*:*",
                     matchCriteriaId: "FD39FE73-2A9D-4C92-AE7A-CA22F84B228D",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix race condition during interface enslave\n\nCommit 5dbbbd01cbba83 (\"ice: Avoid RTNL lock when re-creating\nauxiliary device\") changes a process of re-creation of aux device\nso ice_plug_aux_dev() is called from ice_service_task() context.\nThis unfortunately opens a race window that can result in dead-lock\nwhen interface has left LAG and immediately enters LAG again.\n\nReproducer:\n```\n#!/bin/sh\n\nip link add lag0 type bond mode 1 miimon 100\nip link set lag0\n\nfor n in {1..10}; do\n        echo Cycle: $n\n        ip link set ens7f0 master lag0\n        sleep 1\n        ip link set ens7f0 nomaster\ndone\n```\n\nThis results in:\n[20976.208697] Workqueue: ice ice_service_task [ice]\n[20976.213422] Call Trace:\n[20976.215871]  __schedule+0x2d1/0x830\n[20976.219364]  schedule+0x35/0xa0\n[20976.222510]  schedule_preempt_disabled+0xa/0x10\n[20976.227043]  __mutex_lock.isra.7+0x310/0x420\n[20976.235071]  enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core]\n[20976.251215]  ib_enum_roce_netdev+0xa4/0xe0 [ib_core]\n[20976.256192]  ib_cache_setup_one+0x33/0xa0 [ib_core]\n[20976.261079]  ib_register_device+0x40d/0x580 [ib_core]\n[20976.266139]  irdma_ib_register_device+0x129/0x250 [irdma]\n[20976.281409]  irdma_probe+0x2c1/0x360 [irdma]\n[20976.285691]  auxiliary_bus_probe+0x45/0x70\n[20976.289790]  really_probe+0x1f2/0x480\n[20976.298509]  driver_probe_device+0x49/0xc0\n[20976.302609]  bus_for_each_drv+0x79/0xc0\n[20976.306448]  __device_attach+0xdc/0x160\n[20976.310286]  bus_probe_device+0x9d/0xb0\n[20976.314128]  device_add+0x43c/0x890\n[20976.321287]  __auxiliary_device_add+0x43/0x60\n[20976.325644]  ice_plug_aux_dev+0xb2/0x100 [ice]\n[20976.330109]  ice_service_task+0xd0c/0xed0 [ice]\n[20976.342591]  process_one_work+0x1a7/0x360\n[20976.350536]  worker_thread+0x30/0x390\n[20976.358128]  kthread+0x10a/0x120\n[20976.365547]  ret_from_fork+0x1f/0x40\n...\n[20976.438030] task:ip              state:D stack:    0 pid:213658 ppid:213627 flags:0x00004084\n[20976.446469] Call Trace:\n[20976.448921]  __schedule+0x2d1/0x830\n[20976.452414]  schedule+0x35/0xa0\n[20976.455559]  schedule_preempt_disabled+0xa/0x10\n[20976.460090]  __mutex_lock.isra.7+0x310/0x420\n[20976.464364]  device_del+0x36/0x3c0\n[20976.467772]  ice_unplug_aux_dev+0x1a/0x40 [ice]\n[20976.472313]  ice_lag_event_handler+0x2a2/0x520 [ice]\n[20976.477288]  notifier_call_chain+0x47/0x70\n[20976.481386]  __netdev_upper_dev_link+0x18b/0x280\n[20976.489845]  bond_enslave+0xe05/0x1790 [bonding]\n[20976.494475]  do_setlink+0x336/0xf50\n[20976.502517]  __rtnl_newlink+0x529/0x8b0\n[20976.543441]  rtnl_newlink+0x43/0x60\n[20976.546934]  rtnetlink_rcv_msg+0x2b1/0x360\n[20976.559238]  netlink_rcv_skb+0x4c/0x120\n[20976.563079]  netlink_unicast+0x196/0x230\n[20976.567005]  netlink_sendmsg+0x204/0x3d0\n[20976.570930]  sock_sendmsg+0x4c/0x50\n[20976.574423]  ____sys_sendmsg+0x1eb/0x250\n[20976.586807]  ___sys_sendmsg+0x7c/0xc0\n[20976.606353]  __sys_sendmsg+0x57/0xa0\n[20976.609930]  do_syscall_64+0x5b/0x1a0\n[20976.613598]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n\n1. Command 'ip link ... set nomaster' causes that ice_plug_aux_dev()\n   is called from ice_service_task() context, aux device is created\n   and associated device->lock is taken.\n2. Command 'ip link ... set master...' calls ice's notifier under\n   RTNL lock and that notifier calls ice_unplug_aux_dev(). That\n   function tries to take aux device->lock but this is already taken\n   by ice_plug_aux_dev() in step 1\n3. Later ice_plug_aux_dev() tries to take RTNL lock but this is already\n   taken in step 2\n4. Dead-lock\n\nThe patch fixes this issue by following changes:\n- Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev()\n  call in ice_service_task()\n- The bit is checked in ice_clear_rdma_cap() and only if it is not set\n  then ice_unplug_aux_dev() is called. If it is set (in other words\n  plugging of aux device was requested and ice_plug_aux_dev() is\n  potentially running) then the function only clears the\n---truncated---",
      },
      {
         lang: "es",
         value: "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: corrige la condición de ejecución durante la esclavitud de la interfaz. El commit 5dbbbd01cbba83 (\"ice: evita el bloqueo RTNL al recrear el dispositivo auxiliar\") cambia el proceso de recreación del dispositivo auxiliar para que ice_plug_aux_dev( ) se llama desde el contexto ice_service_task(). Desafortunadamente, esto abre una ventana de ejecución que puede resultar en un punto muerto cuando la interfaz sale de LAG e inmediatamente ingresa a LAG nuevamente. Reproductor: ``` #!/bin/sh enlace ip agregar lag0 tipo modo de enlace 1 miimon 100 enlace ip configurar lag0 para n en {1..10}; do echo Cycle: $n ip link set ens7f0 master lag0 sleep 1 ip link set ens7f0 nomaster done ``` Esto da como resultado: [20976.208697] Cola de trabajo: ice ice_service_task [ice] [20976.213422] Seguimiento de llamadas: [20976.215871] __schedule+0x2d1/ 0x830 [20976.219364] programación+0x35/0xa0 [20976.222510] programación_preempt_disabled+0xa/0x10 [20976.227043] __mutex_lock.isra.7+0x310/0x420 [20976.235071] enum_all_gids_of_de v_cb+0x1c/0x100 [ib_core] [20976.251215] ib_enum_roce_netdev+0xa4/0xe0 [ib_core ] [20976.256192] ib_cache_setup_one+0x33/0xa0 [ib_core] [20976.261079] ib_register_device+0x40d/0x580 [ib_core] [20976.266139] irdma_ib_register_device+0x129/0x250 [irdma] 0976.281409] irdma_probe+0x2c1/0x360 [irdma] [20976.285691] sonda_bus_auxiliar+ 0x45/0x70 [20976.289790] very_probe+0x1f2/0x480 [20976.298509] driver_probe_device+0x49/0xc0 [20976.302609] bus_for_each_drv+0x79/0xc0 [20976.306448] adjuntar+0xdc/0x160 [20976.310286] bus_probe_device+0x9d/0xb0 [20976.314128] dispositivo_add+0x43c/ 0x890 [20976.321287] __auxiliary_device_add+0x43/0x60 [20976.325644] ice_plug_aux_dev+0xb2/0x100 [ice] [20976.330109] ice_service_task+0xd0c/0xed0 [ice] 1] proceso_un_trabajo+0x1a7/0x360 [20976.350536] hilo_trabajador+0x30/0x390 [20976.358128] kthread+0x10a/0x120 [20976.365547] ret_from_fork+0x1f/0x40 ... [20976.438030] tarea:ip estado:D pila: 0 pid:213658 ppid:213627 banderas:0x00004084 [20976.446469] Seguimiento de llamadas: 76.448921] __programación+0x2d1/ 0x830 [20976.452414] programación+0x35/0xa0 [20976.455559] programación_preempt_disabled+0xa/0x10 [20976.460090] __mutex_lock.isra.7+0x310/0x420 [20976.464364 dispositivo_del+0x36/0x 3c0 [20976.467772] ice_unplug_aux_dev+0x1a/0x40 [hielo] [20976.472313 ] ice_lag_event_handler+0x2a2/0x520 [ice] [20976.477288] notifier_call_chain+0x47/0x70 [20976.481386] __netdev_upper_dev_link+0x18b/0x280 [20976.489845] bond_enslave+0xe05/0 x1790 [vinculación] [20976.494475] do_setlink+0x336/0xf50 [20976.502517] __rtnl_newlink+0x529 /0x8b0 [20976.543441] rtnl_newlink+0x43/0x60 [20976.546934] rtnetlink_rcv_msg+0x2b1/0x360 [20976.559238] netlink_rcv_skb+0x4c/0x120 [20976.563079] _unicast+0x196/0x230 [20976.567005] netlink_sendmsg+0x204/0x3d0 [20976.570930] sock_sendmsg+0x4c/0x50 [20976.574423] ____sys_sendmsg+0x1eb/0x250 [20976.586807] ___sys_sendmsg+0x7c/0xc0 [20976.606353] __sys_sendmsg+0x57/0xa0 [20976.609930] call_64+0x5b/0x1a0 [20976.613598] Entry_SYSCALL_64_after_hwframe+0x65/0xca 1. Comando 'ip link... set nomaster' provoca que se llame a ice_plug_aux_dev() desde el contexto ice_service_task(), se crea el dispositivo auxiliar y se toma el dispositivo asociado->bloqueo. 2. El comando 'ip link... set master...' llama al notificador de ice bajo bloqueo RTNL y ese notificador llama a ice_unplug_aux_dev(). Esa función intenta tomar el dispositivo auxiliar->bloqueo, pero esto ya lo tomó ice_plug_aux_dev() en el paso 1 3. Más tarde, ice_plug_aux_dev() intenta tomar el bloqueo RTNL pero esto ya lo tomó en el paso 2 4. Bloqueo muerto El parche soluciona esto problema mediante los siguientes cambios: - El bit ICE_FLAG_PLUG_AUX_DEV se mantiene configurado durante la llamada a ice_plug_aux_dev() en ice_service_task() - El bit se verifica en ice_clear_rdma_cap() y solo si no está configurado, se llama a ice_unplug_aux_dev(). l ---truncado---",
      },
   ],
   id: "CVE-2022-48842",
   lastModified: "2024-11-21T07:34:11.560",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 4.7,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-07-16T13:15:11.577",
   references: [
      {
         source: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
         tags: [
            "Mailing List",
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc",
      },
      {
         source: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
         tags: [
            "Mailing List",
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef",
      },
      {
         source: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
         tags: [
            "Mailing List",
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc",
      },
   ],
   sourceIdentifier: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-362",
            },
            {
               lang: "en",
               value: "CWE-667",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.