CVE-2023-52574

CVE Details

Release Date:	2024-03-02
Impact:	Moderate	What is this?

Description

In the Linux kernel, the following vulnerability has been resolved:\nteam: fix null-ptr-deref when team device type is changed\nGet a null-ptr-deref bug as follows with reproducer [1].\nBUG: kernel NULL pointer dereference, address: 0000000000000228\n...\nRIP: 0010:vlan_dev_hard_header+0x35/0x140 [8021q]\n...\nCall Trace:\n\n? __die+0x24/0x70\n? page_fault_oops+0x82/0x150\n? exc_page_fault+0x69/0x150\n? asm_exc_page_fault+0x26/0x30\n? vlan_dev_hard_header+0x35/0x140 [8021q]\n? vlan_dev_hard_header+0x8e/0x140 [8021q]\nneigh_connected_output+0xb2/0x100\nip6_finish_output2+0x1cb/0x520\n? nf_hook_slow+0x43/0xc0\n? ip6_mtu+0x46/0x80\nip6_finish_output+0x2a/0xb0\nmld_sendpack+0x18f/0x250\nmld_ifc_work+0x39/0x160\nprocess_one_work+0x1e6/0x3f0\nworker_thread+0x4d/0x2f0\n? __pfx_worker_thread+0x10/0x10\nkthread+0xe5/0x120\n? __pfx_kthread+0x10/0x10\nret_from_fork+0x34/0x50\n? __pfx_kthread+0x10/0x10\nret_from_fork_asm+0x1b/0x30\n[1]\n$ teamd -t team0 -d -c '{'runner': {'name': 'loadbalance'}}'\n$ ip link add name t-dummy type dummy\n$ ip link add link t-dummy name t-dummy.100 type vlan id 100\n$ ip link add name t-nlmon type nlmon\n$ ip link set t-nlmon master team0\n$ ip link set t-nlmon nomaster\n$ ip link set t-dummy up\n$ ip link set team0 up\n$ ip link set t-dummy.100 down\n$ ip link set t-dummy.100 master team0\nWhen enslave a vlan device to team device and team device type is changed\nfrom non-ether to ether, header_ops of team device is changed to\nvlan_header_ops. That is incorrect and will trigger null-ptr-deref\nfor vlan->real_dev in vlan_dev_hard_header() because team device is not\na vlan device.\nCache eth_header_ops in team_setup(), then assign cached header_ops to\nheader_ops of team net device when its type is changed from non-ether\nto ether to fix the bug.

See more information about CVE-2023-52574 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	4.4
Vector String:	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Version:	3.1
Attack Vector:	Local
Attack Complexity:	Low
Privileges Required:	High
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	None
Integrity Impact:	None
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 6 (kernel-uek)	ELSA-2024-12606	2024-09-02
Oracle Linux version 7 (kernel-uek)	ELSA-2024-12606	2024-09-02
Oracle Linux version 8 (kernel)	ELSA-2024-3138	2024-05-23
Oracle Linux version 9 (kernel)	ELSA-2024-2394	2024-05-02
Oracle VM version 3 (kernel-uek)	OVMSA-2024-0011	2024-09-03