fkie_cve-2023-52851
Vulnerability from fkie_nvd
Published
2024-05-21 16:15
Modified
2025-01-10 17:43
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF In the unlikely event that workqueue allocation fails and returns NULL in mlx5_mkey_cache_init(), delete the call to mlx5r_umr_resource_cleanup() (which frees the QP) in mlx5_ib_stage_post_ib_reg_umr_init(). This will avoid attempted double free of the same QP when __mlx5_ib_add() does its cleanup. Resolves a splat: Syzkaller reported a UAF in ib_destroy_qp_user workqueue: Failed to create a rescuer kthread for wq "mkey_cache": -EINTR infiniband mlx5_0: mlx5_mkey_cache_init:981:(pid 1642): failed to create work queue infiniband mlx5_0: mlx5_ib_stage_post_ib_reg_umr_init:4075:(pid 1642): mr cache init failed -12 ================================================================== BUG: KASAN: slab-use-after-free in ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) Read of size 8 at addr ffff88810da310a8 by task repro_upstream/1642 Call Trace: <TASK> kasan_report (mm/kasan/report.c:590) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4178) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ... </TASK> Allocated by task 1642: __kmalloc (./include/linux/kasan.h:198 mm/slab_common.c:1026 mm/slab_common.c:1039) create_qp (./include/linux/slab.h:603 ./include/linux/slab.h:720 ./include/rdma/ib_verbs.h:2795 drivers/infiniband/core/verbs.c:1209) ib_create_qp_kernel (drivers/infiniband/core/verbs.c:1347) mlx5r_umr_resource_init (drivers/infiniband/hw/mlx5/umr.c:164) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4070) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ... Freed by task 1642: __kmem_cache_free (mm/slub.c:1826 mm/slub.c:3809 mm/slub.c:3822) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2112) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4076 drivers/infiniband/hw/mlx5/main.c:4065) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ...
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2ef422f063b74adcc4a4a9004b0a87bb55e0a836Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/437f033e30c897bb3723eac9e9003cd9f88d00a3Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4f4a7a7d1404297f2a92df0046f7e64dc5c52dd9Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6387f269d84e6e149499408c4d1fc805017729b2Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/2ef422f063b74adcc4a4a9004b0a87bb55e0a836Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/437f033e30c897bb3723eac9e9003cd9f88d00a3Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/4f4a7a7d1404297f2a92df0046f7e64dc5c52dd9Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/6387f269d84e6e149499408c4d1fc805017729b2Patch
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E81007DE-C3E6-483B-8B77-F444159C176E",
              "versionEndExcluding": "6.1.63",
              "versionStartIncluding": "5.19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "825F64D9-E99F-49AA-8A7B-EF7C2965C5B2",
              "versionEndExcluding": "6.5.12",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CBFF885-A4D3-4F21-B6FD-4D770034C048",
              "versionEndExcluding": "6.6.2",
              "versionStartIncluding": "6.6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF\n\nIn the unlikely event that workqueue allocation fails and returns NULL in\nmlx5_mkey_cache_init(), delete the call to\nmlx5r_umr_resource_cleanup() (which frees the QP) in\nmlx5_ib_stage_post_ib_reg_umr_init().  This will avoid attempted double\nfree of the same QP when __mlx5_ib_add() does its cleanup.\n\nResolves a splat:\n\n   Syzkaller reported a UAF in ib_destroy_qp_user\n\n   workqueue: Failed to create a rescuer kthread for wq \"mkey_cache\": -EINTR\n   infiniband mlx5_0: mlx5_mkey_cache_init:981:(pid 1642):\n   failed to create work queue\n   infiniband mlx5_0: mlx5_ib_stage_post_ib_reg_umr_init:4075:(pid 1642):\n   mr cache init failed -12\n   ==================================================================\n   BUG: KASAN: slab-use-after-free in ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073)\n   Read of size 8 at addr ffff88810da310a8 by task repro_upstream/1642\n\n   Call Trace:\n   \u003cTASK\u003e\n   kasan_report (mm/kasan/report.c:590)\n   ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073)\n   mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198)\n   __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4178)\n   mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402)\n   ...\n   \u003c/TASK\u003e\n\n   Allocated by task 1642:\n   __kmalloc (./include/linux/kasan.h:198 mm/slab_common.c:1026\n   mm/slab_common.c:1039)\n   create_qp (./include/linux/slab.h:603 ./include/linux/slab.h:720\n   ./include/rdma/ib_verbs.h:2795 drivers/infiniband/core/verbs.c:1209)\n   ib_create_qp_kernel (drivers/infiniband/core/verbs.c:1347)\n   mlx5r_umr_resource_init (drivers/infiniband/hw/mlx5/umr.c:164)\n   mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4070)\n   __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168)\n   mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402)\n   ...\n\n   Freed by task 1642:\n   __kmem_cache_free (mm/slub.c:1826 mm/slub.c:3809 mm/slub.c:3822)\n   ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2112)\n   mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198)\n   mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4076\n   drivers/infiniband/hw/mlx5/main.c:4065)\n   __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168)\n   mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402)\n   ..."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: IB/mlx5: corrige el manejo de errores de la etapa inicial para evitar la doble liberaci\u00f3n del mismo QP y UAF. En el improbable caso de que la asignaci\u00f3n de la cola de trabajo falle y devuelva NULL en mlx5_mkey_cache_init(), elimine la llamada a mlx5r_umr_resource_cleanup() (que libera el QP) en mlx5_ib_stage_post_ib_reg_umr_init(). Esto evitar\u00e1 intentos de double free del mismo QP cuando __mlx5_ib_add() realice su limpieza. Resuelve un problema: Syzkaller inform\u00f3 un UAF en ib_destroy_qp_user workqueue: No se pudo crear un kthread de rescate para wq \"mkey_cache\": -EINTR infiniband mlx5_0: mlx5_mkey_cache_init:981:(pid 1642): no se pudo crear la cola de trabajo infiniband mlx5_0: mlx5_ib_stage_post_ib_reg_umr_ inicio: 4075: (pid 1642): el inicio de cach\u00e9 de mr fall\u00f3 -12 ========================================= =========================== BUG: KASAN: uso de losa despu\u00e9s de la liberaci\u00f3n en ib_destroy_qp_user (drivers/infiniband/core/verbs.c :2073) Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff88810da310a8 mediante la tarea repro_upstream/1642 Rastreo de llamadas:  kasan_report (mm/kasan/report.c:590) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) mlx5r_umr_resource_cleanup (drivers /infiniband/hw/mlx5/umr.c:198) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4178) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ...  Asignado por la tarea 1642: __kmalloc (./include/linux/kasan.h:198 mm/slab_common.c:1026 mm/slab_common.c:1039) create_qp (./include/linux/slab.h:603 ./ include/linux/slab.h:720 ./include/rdma/ib_verbs.h:2795 drivers/infiniband/core/verbs.c:1209) ib_create_qp_kernel (drivers/infiniband/core/verbs.c:1347) mlx5r_umr_resource_init (drivers/ infiniband/hw/mlx5/umr.c:164) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4070) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/ hw/mlx5/main.c:4402) ... Liberado por la tarea 1642: __kmem_cache_free (mm/slub.c:1826 mm/slub.c:3809 mm/slub.c:3822) ib_destroy_qp_user (drivers/infiniband/core/ verbs.c:2112) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4076 drivers/infiniband/hw/mlx5/main.c:4065 ) __mlx5_ib_add (controladores/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (controladores/infiniband/hw/mlx5/main.c:4402) ..."
    }
  ],
  "id": "CVE-2023-52851",
  "lastModified": "2025-01-10T17:43:34.967",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-05-21T16:15:22.160",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/2ef422f063b74adcc4a4a9004b0a87bb55e0a836"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/437f033e30c897bb3723eac9e9003cd9f88d00a3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/4f4a7a7d1404297f2a92df0046f7e64dc5c52dd9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/6387f269d84e6e149499408c4d1fc805017729b2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/2ef422f063b74adcc4a4a9004b0a87bb55e0a836"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/437f033e30c897bb3723eac9e9003cd9f88d00a3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/4f4a7a7d1404297f2a92df0046f7e64dc5c52dd9"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/6387f269d84e6e149499408c4d1fc805017729b2"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-415"
        },
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.