CVE-2024-36979: net: bridge: mst: fix vlan use-after-free
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: mst: fix vlan use-after-free
syzbot reported a suspicious rcu usage[1] in bridge's mst code. While fixing it I noticed that nothing prevents a vlan to be freed while walking the list from the same path (br forward delay timer). Fix the rcu usage and also make sure we are not accessing freed memory by making brmstvlansetstate use rcu read lock.
[1] WARNING: suspicious RCU usage 6.9.0-rc6-syzkaller #0 Not tainted ----------------------------- net/bridge/brprivate.h:1599 suspicious rcudereferenceprotected() usage! ... stack backtrace: CPU: 1 PID: 8017 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <IRQ> dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:114 lockdeprcususpicious+0x221/0x340 kernel/locking/lockdep.c:6712 nbpvlangroup net/bridge/brprivate.h:1599 [inline] brmstsetstate+0x1ea/0x650 net/bridge/brmst.c:105 brsetstate+0x28a/0x7b0 net/bridge/brstp.c:47 brforwarddelaytimerexpired+0x176/0x440 net/bridge/brstptimer.c:88 calltimerfn+0x18e/0x650 kernel/time/timer.c:1793 expiretimers kernel/time/timer.c:1844 [inline] runtimers kernel/time/timer.c:2418 [inline] runtimerbase+0x66a/0x8e0 kernel/time/timer.c:2429 runtimerbase kernel/time/timer.c:2438 [inline] runtimersoftirq+0xb7/0x170 kernel/time/timer.c:2448 dosoftirq+0x2c6/0x980 kernel/softirq.c:554 invokesoftirq kernel/softirq.c:428 [inline] irqexitrcu+0xf2/0x1c0 kernel/softirq.c:633 irqexitrcu+0x9/0x30 kernel/softirq.c:645 instrsysvecapictimerinterrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvecapictimerinterrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 </IRQ> <TASK> asmsysvecapictimerinterrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lockacquire+0x264/0x550 kernel/locking/lockdep.c:5758 Code: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25 RSP: 0018:ffffc90013657100 EFLAGS: 00000206 RAX: 0000000000000001 RBX: 1ffff920026cae2c RCX: 0000000000000001 RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60 RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0 R10: dffffc0000000000 R11: fffffbfff25dfca1 R12: 1ffff920026cae28 R13: dffffc0000000000 R14: ffffc90013657160 R15: 0000000000000246
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: mst: fix vlan use-after-free
The Linux kernel CVE team has assigned CVE-2024-36979 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024061945-CVE-2024-36979-b4a6@gregkh/T
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by a vlan use-after-free. A local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36979?
CVE-2024-36979 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-36979?
To mitigate CVE-2024-36979, update the Linux kernel to versions 6.1.93, 6.6.33, 6.8.12, 6.9.3 or newer.
Which Linux kernel versions are affected by CVE-2024-36979?
CVE-2024-36979 affects Linux kernel versions from 5.18 up to but not including 6.1.93, and various 6.x versions up to 6.10.
What type of vulnerability is CVE-2024-36979?
CVE-2024-36979 is a use-after-free vulnerability in the bridge's MST code in the Linux kernel.
How can I determine if my system is affected by CVE-2024-36979?
Check the version of the Linux kernel running on your system to see if it falls within the affected ranges for CVE-2024-36979.