mac802154: check local interfaces before deleting sdata list
In the Linux kernel, the following vulnerability has been resolved: mac802154: check local interfaces before deleting sdata list syzkaller reported a corrupted list in ieee802154_if_remove. [1] Remove an IEEE 802.15.4 network interface after unregister an IEEE 802.15.4 hardware device from the system. CPU0 CPU1 ==== ==== genl_family_rcv_msg_doit ieee802154_unregister_hw ieee802154_del_iface ieee802154_remove_interfaces rdev_del_virtual_intf_deprecated list_del(&sdata->list) ieee802154_if_remove list_del_rcu The net device has been unregistered, since the rcu grace period, unregistration must be run before ieee802154_if_remove. To avoid this issue, add a check for local->interfaces before deleting sdata list. [1] kernel BUG at lib/list_debug.c:58! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 6277 Comm: syz-executor157 Not tainted 6.12.0-rc6-syzkaller-00005-g557329bcecc2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:__list_del_entry_valid_or_report+0xf4/0x140 lib/list_debug.c:56 Code: e8 a1 7e 00 07 90 0f 0b 48 c7 c7 e0 37 60 8c 4c 89 fe e8 8f 7e 00 07 90 0f 0b 48 c7 c7 40 38 60 8c 4c 89 fe e8 7d 7e 00 07 90 <0f> 0b 48 c7 c7 a0 38 60 8c 4c 89 fe e8 6b 7e 00 07 90 0f 0b 48 c7 RSP: 0018:ffffc9000490f3d0 EFLAGS: 00010246 RAX: 000000000000004e RBX: dead000000000122 RCX: d211eee56bb28d00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffff88805b278dd8 R08: ffffffff8174a12c R09
CVE-2024-57948
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-57948
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "62610ad21870a8cf842d4a48f07c3a964e1d2622",
"lessThan": "0d11dc30edfc4acef0acef130bb5ca596317190a",
"versionType": "git"
},
{
"status": "affected",
"version": "62610ad21870a8cf842d4a48f07c3a964e1d2622",
"lessThan": "98ea165a2ac240345c48b57c0a3d08bbcad02929",
"versionType": "git"
},
{
"status": "affected",
"version": "62610ad21870a8cf842d4a48f07c3a964e1d2622",
"lessThan": "80aee0bc0dbe253b6692d33e64455dc742fc52f1",
"versionType": "git"
},
{
"status": "affected",
"version": "62610ad21870a8cf842d4a48f07c3a964e1d2622",
"lessThan": "41e4ca8acba39f1cecff2dfdf14ace4ee52c4272",
"versionType": "git"
},
{
"status": "affected",
"version": "62610ad21870a8cf842d4a48f07c3a964e1d2622",
"lessThan": "2e41e98c4e79edae338f2662dbdf74ac2245d183",
"versionType": "git"
},
{
"status": "affected",
"version": "62610ad21870a8cf842d4a48f07c3a964e1d2622",
"lessThan": "b856d2c1384bc5a7456262afd21aa439ee5cdf6e",
"versionType": "git"
},
{
"status": "affected",
"version": "62610ad21870a8cf842d4a48f07c3a964e1d2622",
"lessThan": "eb09fbeb48709fe66c0d708aed81e910a577a30a",
"versionType": "git"
}
],
"programFiles": [
"net/mac802154/iface.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.4.290",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.234",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.177",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.127",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.74",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.11",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/mac802154/iface.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2024-57948
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #26852 · Revision 1
- Added to Heist Feed
- Publisher date