Bug 1220924 (CVE-2023-52522)

Summary:	VUL-0: CVE-2023-52522: kernel: net: fix possible store tearing in neigh_periodic_work()
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Denis Kirjanov <denis.kirjanov>
Status:	IN_PROGRESS ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	gabriele.sonnu, mhocko, osalvador
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/396071/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-52522:5.5:(AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-03-05 09:18:09 UTC

In the Linux kernel, the following vulnerability has been resolved:

net: fix possible store tearing in neigh_periodic_work()

While looking at a related syzbot report involving neigh_periodic_work(),
I found that I forgot to add an annotation when deleting an
RCU protected item from a list.

Readers use rcu_deference(*np), we need to use either
rcu_assign_pointer() or WRITE_ONCE() on writer side
to prevent store tearing.

I use rcu_assign_pointer() to have lockdep support,
this was the choice made in neigh_flush_dev().

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52522
https://www.cve.org/CVERecord?id=CVE-2023-52522
https://git.kernel.org/stable/c/147d89ee41434b97043c2dcb17a97dc151859baa
https://git.kernel.org/stable/c/25563b581ba3a1f263a00e8c9a97f5e7363be6fd
https://git.kernel.org/stable/c/2ea52a2fb8e87067e26bbab4efb8872639240eb0
https://git.kernel.org/stable/c/95eabb075a5902f4c0834ab1fb12dc35730c05af
https://git.kernel.org/stable/c/a75152d233370362eebedb2643592e7c883cc9fc
https://git.kernel.org/stable/c/f82aac8162871e87027692b36af335a2375d4580
https://bugzilla.redhat.com/show_bug.cgi?id=2267795

Comment 1 Gabriele Sonnu 2024-03-05 09:53:20 UTC

Offending commit (767e97e1e0db) found in:

 - SLE12-SP5
 - SLE15-SP4
 - SLE15-SP5
 - SLE15-SP6
 - cve/linux-3.0
 - cve/linux-4.12
 - cve/linux-4.4
 - cve/linux-5.3
 - stable

stable and SLE15-SP6 already contain the fix, tracking other branches as affected.

Comment 2 Gabriele Sonnu 2024-03-05 09:57:49 UTC

Forgot fix, is: 95eabb075a59

Comment 12 Oscar Salvador 2024-04-15 12:53:26 UTC

@Denis, could you have a look?

thanks

./scripts/check-kernel-fix CVE-2023-52522
25563b581ba3 ("net: fix possible store tearing in neigh_periodic_work()") merged v6.6-rc5~22^2~37
Fixes: 767e97e1e0db ("neigh: RCU conversion of struct neighbour") merged v2.6.37-rc1~147^2~204
Security fix for CVE-2023-52522 bsc#1220924 with CVSS 5.5
..............................
ACTION NEEDED!
SLE15-SP5: MANUAL: backport 25563b581ba3a1f263a00e8c9a97f5e7363be6fd (Fixes 767e97e1e0db)
SLE12-SP5: MANUAL: backport 25563b581ba3a1f263a00e8c9a97f5e7363be6fd (Fixes 767e97e1e0db)
SLE12-SP3-TD: MANUAL: backport 25563b581ba3a1f263a00e8c9a97f5e7363be6fd (Fixes 767e97e1e0db)