SUSE: CVE-2022-48744: SUSE Linux Security Advisory

SUSE: CVE-2022-48744: SUSE Linux Security Advisory

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

06/20/2024

Created

08/16/2024

Added

08/09/2024

Modified

08/09/2024

Description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid field-overflowing memcpy() In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for memcpy(), memmove(), and memset(), avoid intentionally writing across neighboring fields. Use flexible arrays instead of zero-element arrays (which look like they are always overflowing) and split the cross-field memcpy() into two halves that can be appropriately bounds-checked by the compiler. We were doing: #define ETH_HLEN14 #define VLAN_HLEN4 ... #define MLX5E_XDP_MIN_INLINE (ETH_HLEN + VLAN_HLEN) ... struct mlx5e_tx_wqe*wqe= mlx5_wq_cyc_get_wqe(wq, pi); ... struct mlx5_wqe_eth_seg*eseg = &wqe->eth; struct mlx5_wqe_data_seg *dseg = wqe->data; ... memcpy(eseg->inline_hdr.start, xdptxd->data, MLX5E_XDP_MIN_INLINE); target is wqe->eth.inline_hdr.start (which the compiler sees as being 2 bytes in size), but copying 18, intending to write across start (really vlan_tci, 2 bytes). The remaining 16 bytes get written into wqe->data[0], covering byte_count (4 bytes), lkey (4 bytes), and addr (8 bytes). struct mlx5e_tx_wqe { struct mlx5_wqe_ctrl_seg ctrl; /* 016 */ struct mlx5_wqe_eth_segeth;/*1616 */ struct mlx5_wqe_data_seg data[]; /*32 0 */ /* size: 32, cachelines: 1, members: 3 */ /* last cacheline: 32 bytes */ }; struct mlx5_wqe_eth_seg { u8 swp_outer_l4_offset;/* 0 1 */ u8 swp_outer_l3_offset;/* 1 1 */ u8 swp_inner_l4_offset;/* 2 1 */ u8 swp_inner_l3_offset;/* 3 1 */ u8 cs_flags; /* 4 1 */ u8 swp_flags;/* 5 1 */ __be16 mss;/* 6 2 */ __be32 flow_table_metadata;/* 8 4 */ union { struct { __be16 sz; /*12 2 */ u8 start[2]; /*14 2 */ } inline_hdr;/*12 4 */ struct { __be16 type; /*12 2 */ __be16 vlan_tci; /*14 2 */ } insert;/*12 4 */ __be32 trailer;/*12 4 */ }; /*12 4 */ /* size: 16, cachelines: 1, members: 9 */ /* last cacheline: 16 bytes */ }; struct mlx5_wqe_data_seg { __be32 byte_count; /* 0 4 */ __be32 lkey; /* 4 4 */ __be64 addr; /* 8 8 */ /* size: 16, cachelines: 1, members: 3 */ /* last cacheline: 16 bytes */ }; So, split the memcpy() so the compiler can reason about the buffer sizes. "pahole" shows no size nor member offset changes to struct mlx5e_tx_wqe nor struct mlx5e_umr_wqe. "objdump -d" shows no meaningful object code changes (i.e. only source line number induced differences and optimizations).

Solution(s)

• suse-upgrade-cluster-md-kmp-azure
• suse-upgrade-cluster-md-kmp-rt
• suse-upgrade-dlm-kmp-azure
• suse-upgrade-dlm-kmp-rt
• suse-upgrade-gfs2-kmp-azure
• suse-upgrade-gfs2-kmp-rt
• suse-upgrade-kernel-azure
• suse-upgrade-kernel-azure-devel
• suse-upgrade-kernel-azure-extra
• suse-upgrade-kernel-azure-livepatch-devel
• suse-upgrade-kernel-azure-optional
• suse-upgrade-kernel-azure-vdso
• suse-upgrade-kernel-devel-azure
• suse-upgrade-kernel-devel-rt
• suse-upgrade-kernel-rt
• suse-upgrade-kernel-rt-devel
• suse-upgrade-kernel-rt-extra
• suse-upgrade-kernel-rt-livepatch
• suse-upgrade-kernel-rt-livepatch-devel
• suse-upgrade-kernel-rt-optional
• suse-upgrade-kernel-rt-vdso
• suse-upgrade-kernel-rt_debug
• suse-upgrade-kernel-rt_debug-devel
• suse-upgrade-kernel-rt_debug-livepatch-devel
• suse-upgrade-kernel-rt_debug-vdso
• suse-upgrade-kernel-source-azure
• suse-upgrade-kernel-source-rt
• suse-upgrade-kernel-syms-azure
• suse-upgrade-kernel-syms-rt
• suse-upgrade-kselftests-kmp-azure
• suse-upgrade-kselftests-kmp-rt
• suse-upgrade-ocfs2-kmp-azure
• suse-upgrade-ocfs2-kmp-rt
• suse-upgrade-reiserfs-kmp-azure
• suse-upgrade-reiserfs-kmp-rt

References

• https://attackerkb.com/topics/cve-2022-48744
• CVE - 2022-48744