CVE-2024-35852

CVE Details

Release Date:

2024-05-17

Description

In the Linux kernel, the following vulnerability has been resolved:\nmlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work\nThe rehash delayed work is rescheduled with a delay if the number of\ncredits at end of the work is not negative as supposedly it means that\nthe migration ended. Otherwise, it is rescheduled immediately.\nAfter 'mlxsw: spectrum_acl_tcam: Fix possible use-after-free during\nrehash' the above is no longer accurate as a non-negative number of\ncredits is no longer indicative of the migration being done. It can also\nhappen if the work encountered an error in which case the migration will\nresume the next time the work is scheduled.\nThe significance of the above is that it is possible for the work to be\npending and associated with hints that were allocated when the migration\nstarted. This leads to the hints being leaked [1] when the work is\ncanceled while pending as part of ACL region dismantle.\nFix by freeing the hints if hints are associated with a work that was\ncanceled while pending.\nBlame the original commit since the reliance on not having a pending\nwork associated with hints is fragile.\n[1]\nunreferenced object 0xffff88810e7c3000 (size 256):\ncomm 'kworker/0:16', pid 176, jiffies 4295460353\nhex dump (first 32 bytes):\n00 30 95 11 81 88 ff ff 61 00 00 00 00 00 00 80 .0......a.......\n00 00 61 00 40 00 00 00 00 00 00 00 04 00 00 00 ..a.@...........\nbacktrace (crc 2544ddb9):\n[<00000000cf8cfab3>] kmalloc_trace+0x23f/0x2a0\n[<000000004d9a1ad9>] objagg_hints_get+0x42/0x390\n[<000000000b143cf3>] mlxsw_sp_acl_erp_rehash_hints_get+0xca/0x400\n[<0000000059bdb60a>] mlxsw_sp_acl_tcam_vregion_rehash_work+0x868/0x1160\n[<00000000e81fd734>] process_one_work+0x59c/0xf20\n[<00000000ceee9e81>] worker_thread+0x799/0x12c0\n[<00000000bda6fe39>] kthread+0x246/0x300\n[<0000000070056d23>] ret_from_fork+0x34/0x70\n[<00000000dea2b93e>] ret_from_fork_asm+0x1a/0x30

See more information about CVE-2024-35852 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	5.5	CVSS Vector:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector:	Local network	Attack Complexity:	Low
Privileges Required:	Low	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	None	Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (kernel)	ELSA-2024-4211	2024-07-02
Oracle Linux version 9 (kernel)	ELSA-2024-5363	2024-08-14