{
   "containers": {
      "cna": {
         "providerMetadata": {
            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
         },
         "descriptions": [
            {
               "lang": "en",
               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update\n\nThe rule activity update delayed work periodically traverses the list of\nconfigured rules and queries their activity from the device.\n\nAs part of this task it accesses the entry pointed by 'ventry->entry',\nbut this entry can be changed concurrently by the rehash delayed work,\nleading to a use-after-free [1].\n\nFix by closing the race and perform the activity query under the\n'vregion->lock' mutex.\n\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140\nRead of size 8 at addr ffff8881054ed808 by task kworker/0:18/181\n\nCPU: 0 PID: 181 Comm: kworker/0:18 Not tainted 6.9.0-rc2-custom-00781-gd5ab772d32f7 #2\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work\nCall Trace:\n <TASK>\n dump_stack_lvl+0xc6/0x120\n print_report+0xce/0x670\n kasan_report+0xd7/0x110\n mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140\n mlxsw_sp_acl_rule_activity_update_work+0x219/0x400\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nAllocated by task 1039:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc+0x19c/0x360\n mlxsw_sp_acl_tcam_entry_create+0x7b/0x1f0\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x30d/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n\nFreed by task 1039:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n poison_slab_object+0x102/0x170\n __kasan_slab_free+0x14/0x30\n kfree+0xc1/0x290\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30"
            }
         ],
         "affected": [
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "unaffected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c"
               ],
               "versions": [
                  {
                     "version": "2bffc5322fd8",
                     "lessThan": "1b73f6e4ea77",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "2bffc5322fd8",
                     "lessThan": "e24d24874247",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "2bffc5322fd8",
                     "lessThan": "c17976b42d54",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "2bffc5322fd8",
                     "lessThan": "b996e8699da8",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "2bffc5322fd8",
                     "lessThan": "feabdac2057e",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "2bffc5322fd8",
                     "lessThan": "b183b915beef",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "2bffc5322fd8",
                     "lessThan": "79b5b4b18bc8",
                     "status": "affected",
                     "versionType": "git"
                  }
               ]
            },
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "affected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c"
               ],
               "versions": [
                  {
                     "version": "5.1",
                     "status": "affected"
                  },
                  {
                     "version": "0",
                     "lessThan": "5.1",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.4.275",
                     "lessThanOrEqual": "5.4.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.10.216",
                     "lessThanOrEqual": "5.10.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.15.158",
                     "lessThanOrEqual": "5.15.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.1.90",
                     "lessThanOrEqual": "6.1.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.6.30",
                     "lessThanOrEqual": "6.6.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.8.9",
                     "lessThanOrEqual": "6.8.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.9",
                     "lessThanOrEqual": "*",
                     "status": "unaffected",
                     "versionType": "original_commit_for_fix"
                  }
               ]
            }
         ],
         "references": [
            {
               "url": "https://git.kernel.org/stable/c/1b73f6e4ea770410a937a8db98f77e52594d23a0"
            },
            {
               "url": "https://git.kernel.org/stable/c/e24d2487424779c02760ff50cd9021b8676e19ef"
            },
            {
               "url": "https://git.kernel.org/stable/c/c17976b42d546ee118ca300db559630ee96fb758"
            },
            {
               "url": "https://git.kernel.org/stable/c/b996e8699da810e4c915841d6aaef761007f933a"
            },
            {
               "url": "https://git.kernel.org/stable/c/feabdac2057e863d0e140a2adf3d232eb4882db4"
            },
            {
               "url": "https://git.kernel.org/stable/c/b183b915beef818a25e3154d719ca015a1ae0770"
            },
            {
               "url": "https://git.kernel.org/stable/c/79b5b4b18bc85b19d3a518483f9abbbe6d7b3ba4"
            }
         ],
         "title": "mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update",
         "x_generator": {
            "engine": "bippy-a5840b7849dd"
         }
      }
   },
   "cveMetadata": {
      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
      "cveID": "CVE-2024-35855",
      "requesterUserId": "gregkh@kernel.org",
      "serial": "1",
      "state": "PUBLISHED"
   },
   "dataType": "CVE_RECORD",
   "dataVersion": "5.0"
}