CVE-2024-26615
"Linux SMC net/smc Kernel Null Pointer Dereference Vulnerability"
Description
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix illegal rmb_desc access in SMC-D connection dump A crash was found when dumping SMC-D connections. It can be reproduced by following steps: - run nginx/wrk test: smc_run nginx smc_run wrk -t 16 -c 1000 -d <duration> -H 'Connection: Close' <URL> - continuously dump SMC-D connections in parallel: watch -n 1 'smcss -D' BUG: kernel NULL pointer dereference, address: 0000000000000030 CPU: 2 PID: 7204 Comm: smcss Kdump: loaded Tainted: G E 6.7.0+ #55 RIP: 0010:__smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x66/0x150 ? exc_page_fault+0x69/0x140 ? asm_exc_page_fault+0x26/0x30 ? __smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] ? __kmalloc_node_track_caller+0x35d/0x430 ? __alloc_skb+0x77/0x170 smc_diag_dump_proto+0xd0/0xf0 [smc_diag] smc_diag_dump+0x26/0x60 [smc_diag] netlink_dump+0x19f/0x320 __netlink_dump_start+0x1dc/0x300 smc_diag_handler_dump+0x6a/0x80 [smc_diag] ? __pfx_smc_diag_dump+0x10/0x10 [smc_diag] sock_diag_rcv_msg+0x121/0x140 ? __pfx_sock_diag_rcv_msg+0x10/0x10 netlink_rcv_skb+0x5a/0x110 sock_diag_rcv+0x28/0x40 netlink_unicast+0x22a/0x330 netlink_sendmsg+0x1f8/0x420 __sock_sendmsg+0xb0/0xc0 ____sys_sendmsg+0x24e/0x300 ? copy_msghdr_from_user+0x62/0x80 ___sys_sendmsg+0x7c/0xd0 ? __do_fault+0x34/0x160 ? do_read_fault+0x5f/0x100 ? do_fault+0xb0/0x110 ? __handle_mm_fault+0x2b0/0x6c0 __sys_sendmsg+0x4d/0x80 do_syscall_64+0x69/0x180 entry_SYSCALL_64_after_hwframe+0x6e/0x76 It is possible that the connection is in process of being established when we dump it. Assumed that the connection has been registered in a link group by smc_conn_create() but the rmb_desc has not yet been initialized by smc_buf_create(), thus causing the illegal access to conn->rmb_desc. So fix it by checking before dump.
INFO
Published Date :
March 11, 2024, 6:15 p.m.
Last Modified :
Dec. 12, 2024, 3:31 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-26615.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-26615 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-26615 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Dec. 12, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NIST CWE-476 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.19 up to (excluding) 4.19.307 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.269 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.210 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.149 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.76 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.15 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.7.3 *cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:* Changed Reference Type https://git.kernel.org/stable/c/1fea9969b81c67d0cb1611d1b8b7d19049d937be No Types Assigned https://git.kernel.org/stable/c/1fea9969b81c67d0cb1611d1b8b7d19049d937be Patch Changed Reference Type https://git.kernel.org/stable/c/1fea9969b81c67d0cb1611d1b8b7d19049d937be No Types Assigned https://git.kernel.org/stable/c/1fea9969b81c67d0cb1611d1b8b7d19049d937be Patch Changed Reference Type https://git.kernel.org/stable/c/27aea64838914c6122db5b8bd4bed865c9736f22 No Types Assigned https://git.kernel.org/stable/c/27aea64838914c6122db5b8bd4bed865c9736f22 Patch Changed Reference Type https://git.kernel.org/stable/c/27aea64838914c6122db5b8bd4bed865c9736f22 No Types Assigned https://git.kernel.org/stable/c/27aea64838914c6122db5b8bd4bed865c9736f22 Patch Changed Reference Type https://git.kernel.org/stable/c/5fed92ca32eafbfae8b6bee8ca34cca71c6a8b6d No Types Assigned https://git.kernel.org/stable/c/5fed92ca32eafbfae8b6bee8ca34cca71c6a8b6d Patch Changed Reference Type https://git.kernel.org/stable/c/5fed92ca32eafbfae8b6bee8ca34cca71c6a8b6d No Types Assigned https://git.kernel.org/stable/c/5fed92ca32eafbfae8b6bee8ca34cca71c6a8b6d Patch Changed Reference Type https://git.kernel.org/stable/c/68b888d51ac82f2b96bf5e077a31d76afcdef25a No Types Assigned https://git.kernel.org/stable/c/68b888d51ac82f2b96bf5e077a31d76afcdef25a Patch Changed Reference Type https://git.kernel.org/stable/c/68b888d51ac82f2b96bf5e077a31d76afcdef25a No Types Assigned https://git.kernel.org/stable/c/68b888d51ac82f2b96bf5e077a31d76afcdef25a Patch Changed Reference Type https://git.kernel.org/stable/c/6994dba06321e3c48fdad0ba796a063d9d82183a No Types Assigned https://git.kernel.org/stable/c/6994dba06321e3c48fdad0ba796a063d9d82183a Patch Changed Reference Type https://git.kernel.org/stable/c/6994dba06321e3c48fdad0ba796a063d9d82183a No Types Assigned https://git.kernel.org/stable/c/6994dba06321e3c48fdad0ba796a063d9d82183a Patch Changed Reference Type https://git.kernel.org/stable/c/8f3f9186e5bb96a9c9654c41653210e3ea7e48a6 No Types Assigned https://git.kernel.org/stable/c/8f3f9186e5bb96a9c9654c41653210e3ea7e48a6 Patch Changed Reference Type https://git.kernel.org/stable/c/8f3f9186e5bb96a9c9654c41653210e3ea7e48a6 No Types Assigned https://git.kernel.org/stable/c/8f3f9186e5bb96a9c9654c41653210e3ea7e48a6 Patch Changed Reference Type https://git.kernel.org/stable/c/a164c2922675d7051805cdaf2b07daffe44f20d9 No Types Assigned https://git.kernel.org/stable/c/a164c2922675d7051805cdaf2b07daffe44f20d9 Patch Changed Reference Type https://git.kernel.org/stable/c/a164c2922675d7051805cdaf2b07daffe44f20d9 No Types Assigned https://git.kernel.org/stable/c/a164c2922675d7051805cdaf2b07daffe44f20d9 Patch Changed Reference Type https://git.kernel.org/stable/c/dbc153fd3c142909e564bb256da087e13fbf239c No Types Assigned https://git.kernel.org/stable/c/dbc153fd3c142909e564bb256da087e13fbf239c Patch Changed Reference Type https://git.kernel.org/stable/c/dbc153fd3c142909e564bb256da087e13fbf239c No Types Assigned https://git.kernel.org/stable/c/dbc153fd3c142909e564bb256da087e13fbf239c Patch Changed Reference Type https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html No Types Assigned https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Patch Changed Reference Type https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html No Types Assigned https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html Patch -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/1fea9969b81c67d0cb1611d1b8b7d19049d937be Added Reference https://git.kernel.org/stable/c/27aea64838914c6122db5b8bd4bed865c9736f22 Added Reference https://git.kernel.org/stable/c/5fed92ca32eafbfae8b6bee8ca34cca71c6a8b6d Added Reference https://git.kernel.org/stable/c/68b888d51ac82f2b96bf5e077a31d76afcdef25a Added Reference https://git.kernel.org/stable/c/6994dba06321e3c48fdad0ba796a063d9d82183a Added Reference https://git.kernel.org/stable/c/8f3f9186e5bb96a9c9654c41653210e3ea7e48a6 Added Reference https://git.kernel.org/stable/c/a164c2922675d7051805cdaf2b07daffe44f20d9 Added Reference https://git.kernel.org/stable/c/dbc153fd3c142909e564bb256da087e13fbf239c Added Reference https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Added Reference https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 05, 2024
Action Type Old Value New Value Removed Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Removed Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 27, 2024
Action Type Old Value New Value Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html [No types assigned] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2024
Action Type Old Value New Value Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html [No types assigned] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 29, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2024
Action Type Old Value New Value -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Mar. 11, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: net/smc: fix illegal rmb_desc access in SMC-D connection dump A crash was found when dumping SMC-D connections. It can be reproduced by following steps: - run nginx/wrk test: smc_run nginx smc_run wrk -t 16 -c 1000 -d <duration> -H 'Connection: Close' <URL> - continuously dump SMC-D connections in parallel: watch -n 1 'smcss -D' BUG: kernel NULL pointer dereference, address: 0000000000000030 CPU: 2 PID: 7204 Comm: smcss Kdump: loaded Tainted: G E 6.7.0+ #55 RIP: 0010:__smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x66/0x150 ? exc_page_fault+0x69/0x140 ? asm_exc_page_fault+0x26/0x30 ? __smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] ? __kmalloc_node_track_caller+0x35d/0x430 ? __alloc_skb+0x77/0x170 smc_diag_dump_proto+0xd0/0xf0 [smc_diag] smc_diag_dump+0x26/0x60 [smc_diag] netlink_dump+0x19f/0x320 __netlink_dump_start+0x1dc/0x300 smc_diag_handler_dump+0x6a/0x80 [smc_diag] ? __pfx_smc_diag_dump+0x10/0x10 [smc_diag] sock_diag_rcv_msg+0x121/0x140 ? __pfx_sock_diag_rcv_msg+0x10/0x10 netlink_rcv_skb+0x5a/0x110 sock_diag_rcv+0x28/0x40 netlink_unicast+0x22a/0x330 netlink_sendmsg+0x1f8/0x420 __sock_sendmsg+0xb0/0xc0 ____sys_sendmsg+0x24e/0x300 ? copy_msghdr_from_user+0x62/0x80 ___sys_sendmsg+0x7c/0xd0 ? __do_fault+0x34/0x160 ? do_read_fault+0x5f/0x100 ? do_fault+0xb0/0x110 ? __handle_mm_fault+0x2b0/0x6c0 __sys_sendmsg+0x4d/0x80 do_syscall_64+0x69/0x180 entry_SYSCALL_64_after_hwframe+0x6e/0x76 It is possible that the connection is in process of being established when we dump it. Assumed that the connection has been registered in a link group by smc_conn_create() but the rmb_desc has not yet been initialized by smc_buf_create(), thus causing the illegal access to conn->rmb_desc. So fix it by checking before dump. Added Reference Linux https://git.kernel.org/stable/c/27aea64838914c6122db5b8bd4bed865c9736f22 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/1fea9969b81c67d0cb1611d1b8b7d19049d937be [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/5fed92ca32eafbfae8b6bee8ca34cca71c6a8b6d [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/68b888d51ac82f2b96bf5e077a31d76afcdef25a [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/6994dba06321e3c48fdad0ba796a063d9d82183a [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/a164c2922675d7051805cdaf2b07daffe44f20d9 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/8f3f9186e5bb96a9c9654c41653210e3ea7e48a6 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/dbc153fd3c142909e564bb256da087e13fbf239c [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-26615 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-26615
weaknesses.