CVE-2024-36979
Description
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: fix vlan use-after-free syzbot reported a suspicious rcu usage[1] in bridge's mst code. While fixing it I noticed that nothing prevents a vlan to be freed while walking the list from the same path (br forward delay timer). Fix the rcu usage and also make sure we are not accessing freed memory by making br_mst_vlan_set_state use rcu read lock. [1] WARNING: suspicious RCU usage 6.9.0-rc6-syzkaller #0 Not tainted ----------------------------- net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage! ... stack backtrace: CPU: 1 PID: 8017 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712 nbp_vlan_group net/bridge/br_private.h:1599 [inline] br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105 br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47 br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88 call_timer_fn+0x18e/0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2429 run_timer_base kernel/time/timer.c:2438 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448 __do_softirq+0x2c6/0x980 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5758 Code: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25 RSP: 0018:ffffc90013657100 EFLAGS: 00000206 RAX: 0000000000000001 RBX: 1ffff920026cae2c RCX: 0000000000000001 RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60 RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0 R10: dffffc0000000000 R11: fffffbfff25dfca1 R12: 1ffff920026cae28 R13: dffffc0000000000 R14: ffffc90013657160 R15: 0000000000000246
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: alma — https://errata.almalinux.org/9/ALSA-2024-6567.html
Vendor advisory: alma — https://bugzilla.redhat.com/2301637
Vendor advisory: alma — https://bugzilla.redhat.com/2301496
Vendor advisory: alma — https://bugzilla.redhat.com/2301465
Vendor advisory: alma — https://bugzilla.redhat.com/2300713
Vendor advisory: alma — https://bugzilla.redhat.com/2300520
Vendor advisory: alma — https://bugzilla.redhat.com/2300491
Vendor advisory: alma — https://bugzilla.redhat.com/2300429
Vendor advisory: alma — https://bugzilla.redhat.com/2300414
Vendor advisory: alma — https://bugzilla.redhat.com/2300409
Vendor advisory: alma — https://bugzilla.redhat.com/2297520
Vendor advisory: alma — https://bugzilla.redhat.com/2293440
Vendor advisory: alma — https://bugzilla.redhat.com/2293273
Vendor advisory: alma — https://bugzilla.redhat.com/2284402
Vendor advisory: alma — https://bugzilla.redhat.com/2284271
Vendor advisory: alma — https://bugzilla.redhat.com/2282709
Vendor advisory: alma — https://bugzilla.redhat.com/2281727
Vendor advisory: alma — https://bugzilla.redhat.com/2281151
Vendor advisory: alma — https://bugzilla.redhat.com/2281052
Vendor advisory: alma — https://bugzilla.redhat.com/2278206
Vendor advisory: alma — https://bugzilla.redhat.com/2275678
Vendor advisory: alma — https://bugzilla.redhat.com/2273141
Vendor advisory: alma — https://bugzilla.redhat.com/2269436
Vendor advisory: alma — https://bugzilla.redhat.com/2269434
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2024-5102.html
Vendor advisory: alma — https://access.redhat.com/errata/RHSA-2024:5102
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2024-5101.html
Vendor advisory: alma — https://bugzilla.redhat.com/2298108
Vendor advisory: alma — https://bugzilla.redhat.com/2297558
Vendor advisory: alma — https://bugzilla.redhat.com/2297511
Vendor advisory: alma — https://bugzilla.redhat.com/2297474
Vendor advisory: alma — https://bugzilla.redhat.com/2297056
Vendor advisory: alma — https://bugzilla.redhat.com/2296067
Vendor advisory: alma — https://bugzilla.redhat.com/2295914
Vendor advisory: alma — https://bugzilla.redhat.com/2294274
Vendor advisory: alma — https://bugzilla.redhat.com/2293711
Vendor advisory: alma — https://bugzilla.redhat.com/2293700
Vendor advisory: alma — https://bugzilla.redhat.com/2293687
Vendor advisory: alma — https://bugzilla.redhat.com/2293684
Vendor advisory: alma — https://bugzilla.redhat.com/2293657
Vendor advisory: alma — https://bugzilla.redhat.com/2293653
Vendor advisory: alma — https://bugzilla.redhat.com/2293461
Vendor advisory: alma — https://bugzilla.redhat.com/2293444
Vendor advisory: alma — https://bugzilla.redhat.com/2293420
Vendor advisory: alma — https://bugzilla.redhat.com/2293418
Vendor advisory: alma — https://bugzilla.redhat.com/2293383
Vendor advisory: alma — https://bugzilla.redhat.com/2293371
Vendor advisory: alma — https://bugzilla.redhat.com/2293367
Vendor advisory: alma — https://bugzilla.redhat.com/2293348
Vendor advisory: alma — https://bugzilla.redhat.com/2293316
Vendor advisory: alma — https://bugzilla.redhat.com/2293312
Vendor advisory: alma — https://bugzilla.redhat.com/2293276
Vendor advisory: alma — https://bugzilla.redhat.com/2293250
Vendor advisory: alma — https://bugzilla.redhat.com/2293078
Vendor advisory: alma — https://bugzilla.redhat.com/2292331
Vendor advisory: alma — https://bugzilla.redhat.com/2290408
Vendor advisory: alma — https://bugzilla.redhat.com/2284625
Vendor advisory: alma — https://bugzilla.redhat.com/2284590
Vendor advisory: alma — https://bugzilla.redhat.com/2284571
Vendor advisory: alma — https://bugzilla.redhat.com/2284556
Vendor advisory: alma — https://bugzilla.redhat.com/2284541
Vendor advisory: alma — https://bugzilla.redhat.com/2284539
Vendor advisory: alma — https://bugzilla.redhat.com/2284519
Vendor advisory: alma — https://bugzilla.redhat.com/2284513
Vendor advisory: alma — https://bugzilla.redhat.com/2284500
Vendor advisory: alma — https://bugzilla.redhat.com/2284496
Vendor advisory: alma — https://bugzilla.redhat.com/2284488
Vendor advisory: alma — https://bugzilla.redhat.com/2284477
Vendor advisory: alma — https://bugzilla.redhat.com/2284474
Vendor advisory: alma — https://bugzilla.redhat.com/2284465
Vendor advisory: alma — https://bugzilla.redhat.com/2284421
Vendor advisory: alma — https://bugzilla.redhat.com/2284417
Vendor advisory: alma — https://bugzilla.redhat.com/2284400
Vendor advisory: alma — https://bugzilla.redhat.com/2283894
Vendor advisory: alma — https://bugzilla.redhat.com/2283401
Vendor advisory: alma — https://bugzilla.redhat.com/2282950
Vendor advisory: alma — https://bugzilla.redhat.com/2282925
Vendor advisory: alma — https://bugzilla.redhat.com/2282923
Vendor advisory: alma — https://bugzilla.redhat.com/2282896
Vendor advisory: alma — https://bugzilla.redhat.com/2282887
Vendor advisory: alma — https://bugzilla.redhat.com/2282780
Vendor advisory: alma — https://bugzilla.redhat.com/2282772
Vendor advisory: alma — https://bugzilla.redhat.com/2282766
Vendor advisory: alma — https://bugzilla.redhat.com/2282763
Vendor advisory: alma — https://bugzilla.redhat.com/2282759
Vendor advisory: alma — https://bugzilla.redhat.com/2282744
Vendor advisory: alma — https://bugzilla.redhat.com/2282743
Vendor advisory: alma — https://bugzilla.redhat.com/2282742
Vendor advisory: alma — https://bugzilla.redhat.com/2282727
Vendor advisory: alma — https://bugzilla.redhat.com/2282719
Vendor advisory: alma — https://bugzilla.redhat.com/2282717
Vendor advisory: alma — https://bugzilla.redhat.com/2282690
Vendor advisory: alma — https://bugzilla.redhat.com/2282645
Vendor advisory: alma — https://bugzilla.redhat.com/2282642
Vendor advisory: alma — https://bugzilla.redhat.com/2282640
Vendor advisory: alma — https://bugzilla.redhat.com/2282623
Vendor advisory: alma — https://bugzilla.redhat.com/2282615
Vendor advisory: alma — https://bugzilla.redhat.com/2282553
Vendor advisory: alma — https://bugzilla.redhat.com/2282479
Vendor advisory: alma — https://bugzilla.redhat.com/2282373
Vendor advisory: alma — https://bugzilla.redhat.com/2282328
Vendor advisory: alma — https://bugzilla.redhat.com/2281989
Vendor advisory: alma — https://bugzilla.redhat.com/2281968
Vendor advisory: alma — https://bugzilla.redhat.com/2281949
Vendor advisory: alma — https://bugzilla.redhat.com/2281938
Vendor advisory: alma — https://bugzilla.redhat.com/2281833
Vendor advisory: alma — https://bugzilla.redhat.com/2281821
Vendor advisory: alma — https://bugzilla.redhat.com/2281819
Vendor advisory: alma — https://bugzilla.redhat.com/2281758
Vendor advisory: alma — https://bugzilla.redhat.com/2281752
Vendor advisory: alma — https://bugzilla.redhat.com/2281725
Vendor advisory: alma — https://bugzilla.redhat.com/2281682
Vendor advisory: alma — https://bugzilla.redhat.com/2281675
Vendor advisory: alma — https://bugzilla.redhat.com/2281672
Vendor advisory: alma — https://bugzilla.redhat.com/2281667
Vendor advisory: alma — https://bugzilla.redhat.com/2281664
Vendor advisory: alma — https://bugzilla.redhat.com/2281641
Vendor advisory: alma — https://bugzilla.redhat.com/2281636
Vendor advisory: alma — https://bugzilla.redhat.com/2281519
Vendor advisory: alma — https://bugzilla.redhat.com/2281510
Vendor advisory: alma — https://bugzilla.redhat.com/2281360
Vendor advisory: alma — https://bugzilla.redhat.com/2281326
Vendor advisory: alma — https://bugzilla.redhat.com/2281268
Vendor advisory: alma — https://bugzilla.redhat.com/2281235
Vendor advisory: alma — https://bugzilla.redhat.com/2281221
Vendor advisory: alma — https://bugzilla.redhat.com/2281215
Vendor advisory: alma — https://bugzilla.redhat.com/2281207
Vendor advisory: alma — https://bugzilla.redhat.com/2281190
Vendor advisory: alma — https://bugzilla.redhat.com/2281189
Vendor advisory: alma — https://bugzilla.redhat.com/2281149
Vendor advisory: alma — https://bugzilla.redhat.com/2281133
Vendor advisory: alma — https://bugzilla.redhat.com/2281054
Vendor advisory: alma — https://bugzilla.redhat.com/2280440
Vendor advisory: alma — https://bugzilla.redhat.com/2278989
Vendor advisory: alma — https://bugzilla.redhat.com/2278539
Vendor advisory: alma — https://bugzilla.redhat.com/2278535
Vendor advisory: alma — https://bugzilla.redhat.com/2278515
Vendor advisory: alma — https://bugzilla.redhat.com/2278484
Vendor advisory: alma — https://bugzilla.redhat.com/2278380
Vendor advisory: alma — https://bugzilla.redhat.com/2278279
Vendor advisory: alma — https://bugzilla.redhat.com/2278277
Vendor advisory: alma — https://bugzilla.redhat.com/2278258
Vendor advisory: alma — https://bugzilla.redhat.com/2278256
Vendor advisory: alma — https://bugzilla.redhat.com/2278218
Vendor advisory: alma — https://bugzilla.redhat.com/2278182
Vendor advisory: alma — https://bugzilla.redhat.com/2278178
Vendor advisory: alma — https://bugzilla.redhat.com/2278176
Vendor advisory: alma — https://bugzilla.redhat.com/2277840
Vendor advisory: alma — https://bugzilla.redhat.com/2277238
Vendor advisory: alma — https://bugzilla.redhat.com/2277166
Vendor advisory: alma — https://bugzilla.redhat.com/2275928
Vendor advisory: alma — https://bugzilla.redhat.com/2275761
Vendor advisory: alma — https://bugzilla.redhat.com/2275748
Vendor advisory: alma — https://bugzilla.redhat.com/2275744
Vendor advisory: alma — https://bugzilla.redhat.com/2275711
Vendor advisory: alma — https://bugzilla.redhat.com/2275694
Vendor advisory: alma — https://bugzilla.redhat.com/2275580
Vendor advisory: alma — https://bugzilla.redhat.com/2275573
Vendor advisory: alma — https://bugzilla.redhat.com/2275565
Vendor advisory: alma — https://bugzilla.redhat.com/2273654
Vendor advisory: alma — https://bugzilla.redhat.com/2273427
Vendor advisory: alma — https://bugzilla.redhat.com/2273268
Vendor advisory: alma — https://bugzilla.redhat.com/2273247
Vendor advisory: alma — https://bugzilla.redhat.com/2273242
Vendor advisory: alma — https://bugzilla.redhat.com/2273236
Vendor advisory: alma — https://bugzilla.redhat.com/2273174
Vendor advisory: alma — https://bugzilla.redhat.com/2273117
Vendor advisory: alma — https://bugzilla.redhat.com/2273109
Vendor advisory: alma — https://bugzilla.redhat.com/2272795
Vendor advisory: alma — https://bugzilla.redhat.com/2272782
Vendor advisory: alma — https://bugzilla.redhat.com/2271688
Vendor advisory: alma — https://bugzilla.redhat.com/2271686
Vendor advisory: alma — https://bugzilla.redhat.com/2270700
Vendor advisory: alma — https://bugzilla.redhat.com/2270100
Vendor advisory: alma — https://bugzilla.redhat.com/2270084
Vendor advisory: alma — https://bugzilla.redhat.com/2269211
Vendor advisory: alma — https://bugzilla.redhat.com/2269070
Vendor advisory: alma — https://bugzilla.redhat.com/2268118
Vendor advisory: alma — https://bugzilla.redhat.com/2267787
Vendor advisory: alma — https://bugzilla.redhat.com/2266594
Vendor advisory: alma — https://bugzilla.redhat.com/2266497
Vendor advisory: alma — https://bugzilla.redhat.com/2266347
Vendor advisory: alma — https://bugzilla.redhat.com/2266341
Vendor advisory: alma — https://bugzilla.redhat.com/2265797
Vendor advisory: alma — https://bugzilla.redhat.com/2265650
Vendor advisory: alma — https://bugzilla.redhat.com/2265645
Vendor advisory: alma — https://bugzilla.redhat.com/2263879
Vendor advisory: alma — https://access.redhat.com/errata/RHSA-2024:5101
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2024-36979
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2024:6567
Vendor advisory: rocky — https://errata.rockylinux.org/RXSA-2024:6567
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2024-36979.html
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2024:5101
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2024:5102
Vendor advisory: rocky — https://errata.rockylinux.org/RXSA-2024:5101
Vendor advisory: redhat — https://access.redhat.com/errata/RHSA-2024:6567
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| rhel | 9 | fixed | |
| rocky | 8 | fixed | |
| sles | affected | | |
| rocky | 9 | fixed | |
| debian | bookworm | fixed | 6.1.94-1 |
| debian | bullseye | fixed | 0 |
| debian | forky | fixed | 6.8.12-1 |
| debian | sid | fixed | 6.8.12-1 |
| debian | trixie | fixed | 6.8.12-1 |
| almalinux | 8 | fixed | kernel-doc-4.18.0-553.16.1.el8_10.noarch.rpm |
References
- https://access.redhat.com/errata/RHSA-2024:6567
- https://errata.rockylinux.org/RXSA-2024:5101
- https://errata.rockylinux.org/RLSA-2024:5102
- https://errata.rockylinux.org/RLSA-2024:5101
- https://www.suse.com/security/cve/CVE-2024-36979.html
- https://errata.rockylinux.org/RXSA-2024:6567
- https://errata.rockylinux.org/RLSA-2024:6567
- https://security-tracker.debian.org/tracker/CVE-2024-36979
- https://access.redhat.com/errata/RHSA-2024:5101
- https://bugzilla.redhat.com/2263879
- https://bugzilla.redhat.com/2265645
- https://bugzilla.redhat.com/2265650
- https://bugzilla.redhat.com/2265797
- https://bugzilla.redhat.com/2266341
- https://bugzilla.redhat.com/2266347
- https://bugzilla.redhat.com/2266497
- https://bugzilla.redhat.com/2266594
- https://bugzilla.redhat.com/2267787
- https://bugzilla.redhat.com/2268118
- https://bugzilla.redhat.com/2269070
- https://bugzilla.redhat.com/2269211
- https://bugzilla.redhat.com/2270084
- https://bugzilla.redhat.com/2270100
- https://bugzilla.redhat.com/2270700
- https://bugzilla.redhat.com/2271686
Verify integrity in audit chain (admin only). AS-IS.