tcp: check skb is non-NULL in tcp_rto_delta_us()
In the Linux kernel, the following vulnerability has been resolved: tcp: check skb is non-NULL in tcp_rto_delta_us() We have some machines running stock Ubuntu 20.04.6 which is their 5.4.0-174-generic kernel that are running ceph and recently hit a null ptr dereference in tcp_rearm_rto(). Initially hitting it from the TLP path, but then later we also saw it getting hit from the RACK case as well. Here are examples of the oops messages we saw in each of those cases: Jul 26 15:05:02 rx [11061395.780353] BUG: kernel NULL pointer dereference, address: 0000000000000020 Jul 26 15:05:02 rx [11061395.787572] #PF: supervisor read access in kernel mode Jul 26 15:05:02 rx [11061395.792971] #PF: error_code(0x0000) - not-present page Jul 26 15:05:02 rx [11061395.798362] PGD 0 P4D 0 Jul 26 15:05:02 rx [11061395.801164] Oops: 0000 [#1] SMP NOPTI Jul 26 15:05:02 rx [11061395.805091] CPU: 0 PID: 9180 Comm: msgr-worker-1 Tainted: G W 5.4.0-174-generic #193-Ubuntu Jul 26 15:05:02 rx [11061395.814996] Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023 Jul 26 15:05:02 rx [11061395.825952] RIP: 0010:tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.830656] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3 Jul 26 15:05:02 rx [11061395.849665] RSP: 0018:ffffb75d40003e08 EFLAGS: 00010246 Jul 26
CVE-2024-47684
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-47684
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "e1a10ef7fa876f8510aaec36ea5c0cf34baba410",
"lessThan": "ad4f0a14d6856e68f023fc4e5017cfd881a3dfbc",
"versionType": "git"
},
{
"status": "affected",
"version": "e1a10ef7fa876f8510aaec36ea5c0cf34baba410",
"lessThan": "16e0387d87fc858e34449fdf2b14ed5837f761db",
"versionType": "git"
},
{
"status": "affected",
"version": "e1a10ef7fa876f8510aaec36ea5c0cf34baba410",
"lessThan": "ec31cf42fc4e35bb1248ce6eb1de6de9f851ac86",
"versionType": "git"
},
{
"status": "affected",
"version": "e1a10ef7fa876f8510aaec36ea5c0cf34baba410",
"lessThan": "5c4c03288a4aea705e36aa44119c13d7ee4dce99",
"versionType": "git"
},
{
"status": "affected",
"version": "e1a10ef7fa876f8510aaec36ea5c0cf34baba410",
"lessThan": "96c4983eab2a5da235f7fff90beaf17b008ba029",
"versionType": "git"
},
{
"status": "affected",
"version": "e1a10ef7fa876f8510aaec36ea5c0cf34baba410",
"lessThan": "570f7d8c9bf14f041152ba8353d4330ef7575915",
"versionType": "git"
},
{
"status": "affected",
"version": "e1a10ef7fa876f8510aaec36ea5c0cf34baba410",
"lessThan": "81d18c152e3f82bacadf83bc0a471b2363b9cc18",
"versionType": "git"
},
{
"status": "affected",
"version": "e1a10ef7fa876f8510aaec36ea5c0cf34baba410",
"lessThan": "09aea49fbc7e755a915c405644f347137cdb62b0",
"versionType": "git"
},
{
"status": "affected",
"version": "e1a10ef7fa876f8510aaec36ea5c0cf34baba410",
"lessThan": "c8770db2d54437a5f49417ae7b46f7de23d14db6",
"versionType": "git"
},
{
"status": "affected",
"version": "42a858e036bb26cb559157393b7890cabe70bfc2",
"versionType": "git"
},
{
"status": "affected",
"version": "3.10.108",
"lessThan": "3.11",
"versionType": "semver"
}
],
"programFiles": [
"include/net/tcp.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.13",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.19.323",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.285",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.227",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.168",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.113",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.54",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.10.13",
"versionType": "semver",
"lessThanOrEqual": "6.10.*"
},
{
"status": "unaffected",
"version": "6.11.2",
"versionType": "semver",
"lessThanOrEqual": "6.11.*"
},
{
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/net/tcp.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2024-47684
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #26722 · Revision 1
- Added to Heist Feed
- Publisher date