Skip to content
Heist/ feed
High

net/mlx5e: Don't clone flow post action attributes second time

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Don't clone flow post action attributes second time The code already clones post action attributes in mlx5e_clone_flow_attr_for_post_act(). Creating another copy in mlx5e_tc_post_act_add() is a erroneous leftover from original implementation. Instead, assign handle->attribute to post_attr provided by the caller. Note that cloning the attribute second time is not just wasteful but also causes issues like second copy not being properly updated in neigh update code which leads to following use-after-free: Feb 21 09:02:00 c-237-177-40-045 kernel: BUG: KASAN: use-after-free in mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_report+0xbb/0x1a0 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30 Feb 21 09:02:00 c-237-177-40-045 kernel: __kasan_kmalloc+0x7a/0x90 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_free_info+0x2a/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: ____kasan_slab_free+0x11a/0x1b0 Feb 21 09:02:00 c-237-177-40-045 kernel: page dumped because: kasan: bad access detected Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5_cmd_out_err:803:(pid 8833): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad resour

Announced Source revision 1
Original source ↗

CVE-2023-54262

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2023-54262

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "8300f225268be9ee2c0daf5a3f23929fcdcbf213",
        "lessThan": "c382b693ffcb1f1ebf60d76ab9dedfe9ea13eedf",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8300f225268be9ee2c0daf5a3f23929fcdcbf213",
        "lessThan": "8fd1dac646e6b08d03e3f1ad3c5b34255b1e08e8",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8300f225268be9ee2c0daf5a3f23929fcdcbf213",
        "lessThan": "2d57a514f9ab7d2d40f49b02d93edfcec8c78a9e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8300f225268be9ee2c0daf5a3f23929fcdcbf213",
        "lessThan": "e9fce818fe003b6c527f25517b9ac08eb4661b5d",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.c",
      "drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.h"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.18"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.18",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.28",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.2.15",
        "versionType": "semver",
        "lessThanOrEqual": "6.2.*"
      },
      {
        "status": "unaffected",
        "version": "6.3.2",
        "versionType": "semver",
        "lessThanOrEqual": "6.3.*"
      },
      {
        "status": "unaffected",
        "version": "6.4",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.c",
      "drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.h"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2023-54262

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30372 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement