github - ghsa-rhx4-7vf5-j6rw

ghsa-rhx4-7vf5-j6rw

Vulnerability from github

Published

2024-11-08 06:30

Modified

2024-12-11 18:30

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

In the Linux kernel, the following vulnerability has been resolved:

ice: fix memleak in ice_init_tx_topology()

Fix leak of the FW blob (DDP pkg).

Make ice_cfg_tx_topo() const-correct, so ice_init_tx_topology() can avoid copying whole FW blob. Copy just the topology section, and only when needed. Reuse the buffer allocated for the read of the current topology.

This was found by kmemleak, with the following trace for each PF: [] kmemdup_noprof+0x1d/0x50 [] ice_init_ddp_config+0x100/0x220 [ice] [] ice_init_dev+0x6f/0x200 [ice] [] ice_init+0x29/0x560 [ice] [] ice_probe+0x21d/0x310 [ice]

Constify ice_cfg_tx_topo() @buf parameter. This cascades further down to few more functions.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-50190"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-08T06:15:15Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix memleak in ice_init_tx_topology()\n\nFix leak of the FW blob (DDP pkg).\n\nMake ice_cfg_tx_topo() const-correct, so ice_init_tx_topology() can avoid\ncopying whole FW blob. Copy just the topology section, and only when\nneeded. Reuse the buffer allocated for the read of the current topology.\n\nThis was found by kmemleak, with the following trace for each PF:\n    [\u003cffffffff8761044d\u003e] kmemdup_noprof+0x1d/0x50\n    [\u003cffffffffc0a0a480\u003e] ice_init_ddp_config+0x100/0x220 [ice]\n    [\u003cffffffffc0a0da7f\u003e] ice_init_dev+0x6f/0x200 [ice]\n    [\u003cffffffffc0a0dc49\u003e] ice_init+0x29/0x560 [ice]\n    [\u003cffffffffc0a10c1d\u003e] ice_probe+0x21d/0x310 [ice]\n\nConstify ice_cfg_tx_topo() @buf parameter.\nThis cascades further down to few more functions.",
  "id": "GHSA-rhx4-7vf5-j6rw",
  "modified": "2024-12-11T18:30:37Z",
  "published": "2024-11-08T06:30:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50190"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/43544b4e30732c3d88f423252281915d5bc739b6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c188afdc36113760873ec78cbc036f6b05f77621"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

cve-2024-50190

Vulnerability from cvelistv5

Published

2024-11-08 05:43

Modified

2024-12-19 09:35

Severity ?

Summary

In the Linux kernel, the following vulnerability has been resolved: ice: fix memleak in ice_init_tx_topology() Fix leak of the FW blob (DDP pkg). Make ice_cfg_tx_topo() const-correct, so ice_init_tx_topology() can avoid copying whole FW blob. Copy just the topology section, and only when needed. Reuse the buffer allocated for the read of the current topology. This was found by kmemleak, with the following trace for each PF: [<ffffffff8761044d>] kmemdup_noprof+0x1d/0x50 [<ffffffffc0a0a480>] ice_init_ddp_config+0x100/0x220 [ice] [<ffffffffc0a0da7f>] ice_init_dev+0x6f/0x200 [ice] [<ffffffffc0a0dc49>] ice_init+0x29/0x560 [ice] [<ffffffffc0a10c1d>] ice_probe+0x21d/0x310 [ice] Constify ice_cfg_tx_topo() @buf parameter. This cascades further down to few more functions.

References

▼	URL	Tags
	https://git.kernel.org/stable/c/43544b4e30732c3d88f423252281915d5bc739b6
	https://git.kernel.org/stable/c/c188afdc36113760873ec78cbc036f6b05f77621

Impacted products

Vendor

Product

Version

▼

Linux

Version: cc5776fe183208115e42c044497e193e4671a2b9
Version: cc5776fe183208115e42c044497e193e4671a2b9

Linux

Version: 6.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_ddp.c",
            "drivers/net/ethernet/intel/ice/ice_ddp.h",
            "drivers/net/ethernet/intel/ice/ice_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "43544b4e30732c3d88f423252281915d5bc739b6",
              "status": "affected",
              "version": "cc5776fe183208115e42c044497e193e4671a2b9",
              "versionType": "git"
            },
            {
              "lessThan": "c188afdc36113760873ec78cbc036f6b05f77621",
              "status": "affected",
              "version": "cc5776fe183208115e42c044497e193e4671a2b9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_ddp.c",
            "drivers/net/ethernet/intel/ice/ice_ddp.h",
            "drivers/net/ethernet/intel/ice/ice_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix memleak in ice_init_tx_topology()\n\nFix leak of the FW blob (DDP pkg).\n\nMake ice_cfg_tx_topo() const-correct, so ice_init_tx_topology() can avoid\ncopying whole FW blob. Copy just the topology section, and only when\nneeded. Reuse the buffer allocated for the read of the current topology.\n\nThis was found by kmemleak, with the following trace for each PF:\n    [\u003cffffffff8761044d\u003e] kmemdup_noprof+0x1d/0x50\n    [\u003cffffffffc0a0a480\u003e] ice_init_ddp_config+0x100/0x220 [ice]\n    [\u003cffffffffc0a0da7f\u003e] ice_init_dev+0x6f/0x200 [ice]\n    [\u003cffffffffc0a0dc49\u003e] ice_init+0x29/0x560 [ice]\n    [\u003cffffffffc0a10c1d\u003e] ice_probe+0x21d/0x310 [ice]\n\nConstify ice_cfg_tx_topo() @buf parameter.\nThis cascades further down to few more functions."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:35:07.487Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/43544b4e30732c3d88f423252281915d5bc739b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c188afdc36113760873ec78cbc036f6b05f77621"
        }
      ],
      "title": "ice: fix memleak in ice_init_tx_topology()",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50190",
    "datePublished": "2024-11-08T05:43:46.911Z",
    "dateReserved": "2024-10-21T19:36:19.967Z",
    "dateUpdated": "2024-12-19T09:35:07.487Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted