net/mlx5e: Don't clone flow post action attributes second time
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Don't clone flow post action attributes second time The code already clones post action attributes in mlx5e_clone_flow_attr_for_post_act(). Creating another copy in mlx5e_tc_post_act_add() is a erroneous leftover from original implementation. Instead, assign handle->attribute to post_attr provided by the caller. Note that cloning the attribute second time is not just wasteful but also causes issues like second copy not being properly updated in neigh update code which leads to following use-after-free: Feb 21 09:02:00 c-237-177-40-045 kernel: BUG: KASAN: use-after-free in mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_report+0xbb/0x1a0 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30 Feb 21 09:02:00 c-237-177-40-045 kernel: __kasan_kmalloc+0x7a/0x90 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_free_info+0x2a/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: ____kasan_slab_free+0x11a/0x1b0 Feb 21 09:02:00 c-237-177-40-045 kernel: page dumped because: kasan: bad access detected Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5_cmd_out_err:803:(pid 8833): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad resour
CVE-2023-54262
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2023-54262
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "8300f225268be9ee2c0daf5a3f23929fcdcbf213",
"lessThan": "c382b693ffcb1f1ebf60d76ab9dedfe9ea13eedf",
"versionType": "git"
},
{
"status": "affected",
"version": "8300f225268be9ee2c0daf5a3f23929fcdcbf213",
"lessThan": "8fd1dac646e6b08d03e3f1ad3c5b34255b1e08e8",
"versionType": "git"
},
{
"status": "affected",
"version": "8300f225268be9ee2c0daf5a3f23929fcdcbf213",
"lessThan": "2d57a514f9ab7d2d40f49b02d93edfcec8c78a9e",
"versionType": "git"
},
{
"status": "affected",
"version": "8300f225268be9ee2c0daf5a3f23929fcdcbf213",
"lessThan": "e9fce818fe003b6c527f25517b9ac08eb4661b5d",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.c",
"drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.28",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.2.15",
"versionType": "semver",
"lessThanOrEqual": "6.2.*"
},
{
"status": "unaffected",
"version": "6.3.2",
"versionType": "semver",
"lessThanOrEqual": "6.3.*"
},
{
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.c",
"drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2023-54262
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30372 · Revision 1
- Added to Heist Feed
- Publisher date