iavf: Fix out-of-bounds when setting channels on remove
In the Linux kernel, the following vulnerability has been resolved: iavf: Fix out-of-bounds when setting channels on remove If we set channels greater during iavf_remove(), and waiting reset done would be timeout, then returned with error but changed num_active_queues directly, that will lead to OOB like the following logs. Because the num_active_queues is greater than tx/rx_rings[] allocated actually. Reproducer: [root@host ~]# cat repro.sh #!/bin/bash pf_dbsf="0000:41:00.0" vf0_dbsf="0000:41:02.0" g_pids=() function do_set_numvf() { echo 2 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs sleep $((RANDOM%3+1)) echo 0 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs sleep $((RANDOM%3+1)) } function do_set_channel() { local nic=$(ls -1 --indicator-style=none /sys/bus/pci/devices/${vf0_dbsf}/net/) [ -z "$nic" ] && { sleep $((RANDOM%3)) ; return 1; } ifconfig $nic 192.168.18.5 netmask 255.255.255.0 ifconfig $nic up ethtool -L $nic combined 1 ethtool -L $nic combined 4 sleep $((RANDOM%3)) } function on_exit() { local pid for pid in "${g_pids[@]}"; do kill -0 "$pid" &>/dev/null && kill "$pid" &>/dev/null done g_pids=() } trap "on_exit; exit" EXIT while :; do do_set_numvf ; done & g_pids+=($!) while :; do do_set_channel ; done & g_pids+=($!) wait Result: [ 3506.152887] iavf 0000:41:02.0: Removing device [ 3510.400799] ================================================================== [ 3510.400820] BUG: KASAN: slab-out-of-bounds in iavf_free_all_tx_resources+0x156/0x160 [iavf] [ 3510.400
CVE-2023-53659
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2023-53659
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "1555d83ddbb7204ef60c58aee6ca3bbef2c5e99f",
"lessThan": "b92defe4e8ee86996c16417ad8c804cb4395fddd",
"versionType": "git"
},
{
"status": "affected",
"version": "68d4274034e618b7f190dc9fbfc4f3436a7430f4",
"lessThan": "0fb37ce6c01e17839e26d03222f0b44e6a3ed2b9",
"versionType": "git"
},
{
"status": "affected",
"version": "4e5e6b5d9d1334d3490326b6922a2daaf56a867f",
"lessThan": "6e1d8f1332076a002e6d910d255aa5903d341c56",
"versionType": "git"
},
{
"status": "affected",
"version": "4e5e6b5d9d1334d3490326b6922a2daaf56a867f",
"lessThan": "65ecebc9ac09427b2c65f271cd5e5bd536c3fe38",
"versionType": "git"
},
{
"status": "affected",
"version": "4e5e6b5d9d1334d3490326b6922a2daaf56a867f",
"lessThan": "7c4bced3caa749ce468b0c5de711c98476b23a52",
"versionType": "git"
},
{
"status": "affected",
"version": "5.10.82",
"lessThan": "5.10.188",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.5",
"lessThan": "5.15.123",
"versionType": "semver"
}
],
"programFiles": [
"drivers/net/ethernet/intel/iavf/iavf_ethtool.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.16",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.188",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.123",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.42",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.4.7",
"versionType": "semver",
"lessThanOrEqual": "6.4.*"
},
{
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/ethernet/intel/iavf/iavf_ethtool.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2023-53659
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30300 · Revision 1
- Added to Heist Feed
- Publisher date