mbox series

[SRU,N,0/1] CVE-2024-46800

Message ID 20241009164342.15098-1-bethany.jamison@canonical.com
Headers show
Series CVE-2024-46800 | expand

Message

Bethany Jamison Oct. 9, 2024, 4:43 p.m. UTC 
[Impact]

If netem_dequeue() enqueues packet to inner qdisc and that qdisc
returns __NET_XMIT_STOLEN. The packet is dropped but
qdisc_tree_reduce_backlog() is not called to update the parent's
q.qlen, leading to a use-after-free.

[Fix]

Noble:	Clean cherry-pick from linux-6.10.y
Jammy:	pending (5.15.0-125.135)
Focal:	pending (5.4.0-200.220)
Bionic:	fix sent to esm ML
Xenial:	fix sent to esm ML
Trusty:	won't fix

[Test Case]

Compile and boot tested.

[Where problems could occur]

This fix affects those who use the sched Network Emulation Queuer,
an issue with this would be visible to the user via unexpected 
system behavior or a system crash.

Stephen Hemminger (1):
  sch/netem: fix use after free in netem_dequeue

 net/sched/sch_netem.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

Comments

Guoqing Jiang Oct. 11, 2024, 9:47 a.m. UTC | #1 
Acked-by: Guoqing Jiang <guoqing.jiang@canonical.com>

On 10/10/24 00:43, Bethany Jamison wrote:
> [Impact]
>
> If netem_dequeue() enqueues packet to inner qdisc and that qdisc
> returns __NET_XMIT_STOLEN. The packet is dropped but
> qdisc_tree_reduce_backlog() is not called to update the parent's
> q.qlen, leading to a use-after-free.
>
> [Fix]
>
> Noble:	Clean cherry-pick from linux-6.10.y
> Jammy:	pending (5.15.0-125.135)
> Focal:	pending (5.4.0-200.220)
> Bionic:	fix sent to esm ML
> Xenial:	fix sent to esm ML
> Trusty:	won't fix
>
> [Test Case]
>
> Compile and boot tested.
>
> [Where problems could occur]
>
> This fix affects those who use the sched Network Emulation Queuer,
> an issue with this would be visible to the user via unexpected
> system behavior or a system crash.
>
> Stephen Hemminger (1):
>    sch/netem: fix use after free in netem_dequeue
>
>   net/sched/sch_netem.c | 9 ++++-----
>   1 file changed, 4 insertions(+), 5 deletions(-)
>
ivanhu Oct. 14, 2024, 1:55 a.m. UTC | #2 
Acked-by: Ivan Hu <ivan.hu@canonical.com>


On 10/10/24 00:43, Bethany Jamison wrote:
> [Impact]
> 
> If netem_dequeue() enqueues packet to inner qdisc and that qdisc
> returns __NET_XMIT_STOLEN. The packet is dropped but
> qdisc_tree_reduce_backlog() is not called to update the parent's
> q.qlen, leading to a use-after-free.
> 
> [Fix]
> 
> Noble:	Clean cherry-pick from linux-6.10.y
> Jammy:	pending (5.15.0-125.135)
> Focal:	pending (5.4.0-200.220)
> Bionic:	fix sent to esm ML
> Xenial:	fix sent to esm ML
> Trusty:	won't fix
> 
> [Test Case]
> 
> Compile and boot tested.
> 
> [Where problems could occur]
> 
> This fix affects those who use the sched Network Emulation Queuer,
> an issue with this would be visible to the user via unexpected
> system behavior or a system crash.
> 
> Stephen Hemminger (1):
>    sch/netem: fix use after free in netem_dequeue
> 
>   net/sched/sch_netem.c | 9 ++++-----
>   1 file changed, 4 insertions(+), 5 deletions(-)
>
Roxana Nicolescu Oct. 18, 2024, 12:44 p.m. UTC | #3 
On 09/10/2024 18:43, Bethany Jamison wrote:
> [Impact]
>
> If netem_dequeue() enqueues packet to inner qdisc and that qdisc
> returns __NET_XMIT_STOLEN. The packet is dropped but
> qdisc_tree_reduce_backlog() is not called to update the parent's
> q.qlen, leading to a use-after-free.
>
> [Fix]
>
> Noble:	Clean cherry-pick from linux-6.10.y
> Jammy:	pending (5.15.0-125.135)
> Focal:	pending (5.4.0-200.220)
> Bionic:	fix sent to esm ML
> Xenial:	fix sent to esm ML
> Trusty:	won't fix
>
> [Test Case]
>
> Compile and boot tested.
>
> [Where problems could occur]
>
> This fix affects those who use the sched Network Emulation Queuer,
> an issue with this would be visible to the user via unexpected
> system behavior or a system crash.
>
> Stephen Hemminger (1):
>    sch/netem: fix use after free in netem_dequeue
>
>   net/sched/sch_netem.c | 9 ++++-----
>   1 file changed, 4 insertions(+), 5 deletions(-)
>
Applied to noble:linux master-next branch. Thanks!