CVE-2024-42073

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems

The following two shared buffer operations make use of the Shared Buffer

Status Register (SBSR):

# devlink sb occupancy snapshot pci/0000:01:00.0

# devlink sb occupancy clearmax pci/0000:01:00.0

The register has two masks of 256 bits to denote on which ingress /

egress ports the register should operate on. Spectrum-4 has more than

256 ports, so the register was extended by cited commit with a new

'port_page' field.

However, when filling the register's payload, the driver specifies the

ports as absolute numbers and not relative to the first port of the port

page, resulting in memory corruptions [1].

Fix by specifying the ports relative to the first port of the port page.

[1]

BUG: KASAN: slab-use-after-free in mlxsw_sp_sb_occ_snapshot+0xb6d/0xbc0

Read of size 1 at addr ffff8881068cb00f by task devlink/1566

[...]

Call Trace:

<TASK>

dump_stack

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References