|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: REJECTED: CVE-2024-39362: kernel: i2c: acpi: Unbind mux adapters before delete | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | SMASH SMASH <smash_bz> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED INVALID | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | brahmajit.das, carlos.lopez, jdelvare, mhocko |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/412093/ | ||
| Whiteboard: | CVSSv3.1:SUSE:CVE-2024-39362:4.4:(AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) | ||
| Found By: | Security Response Team | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
SMASH SMASH
2024-06-26 08:18:37 UTC
(In reply to Brahmajit Das from comment #2) > Jean, have you started to work on the backport/have you already submitted > the backport? If not, would you mind if I do it? I have started a discussion with the upstream author of the fix to understand how the bug happened and what exactly were the consequences, and my conclusion at this point is that we don't need to bother with this fix in older kernels. First of all, the known way to trigger the bug it to load and then unload an overlay SSDT ACPI table with certain characteristics. This requires the acpi_configfs kernel module, which is included in our kernels, but is unsupported (it is part of the kernel-default-extra package and taints the kernel when loaded). I don't think this is something our customers would do on production servers anyway, to me it looks like a feature which would be used during the development of hardware and firmware of a system. As a matter of fact, no customer ever reported that bug to us. Secondly, only root can load and unload SSDT tables through configfs, so the bug can't be triggered on purpose by a remote or local unprivileged user. Lastly, the bug causes a warning to be dumped to the kernel log, but as far as I can see, that's all. acpi_unbind_one() is a best-effort function, it returns 0 no matter what. kernfs_remove_by_ame_ns() will gracefully return an error code. I can't see any obvious use-after-free happening so I see no way an attacker could exploit this bug. If the fix was trivial to backport, I'd say let's just take it, but it turns out that the fix uses an API which only exists since kernel v6.3, so there would be an extra effort (including a kABI breakage to workaround) to backport the fix to older kernels, which I don't think is worth it. Also note that I don't think the bug can happen on kernels older than v5.12, because support for ACPI-defined I2C multiplexing was added by commit 98b2b712bc85 ("i2c: i2c-mux-gpio: Enable this driver in ACPI land"). If I'm correct on this then SLE12-SP5 isn't even affected. As a minor addition to comment #3: the author of the fix explained to me that they are actually using SSDT overlay loading and unloading in certain production scenarios (changing hardware components of running production systems). I don't think our own customers would be doing that, and this doesn't change all the other points I made in that comment, but I wanted to clarify that my first impression that this feature was only used during development, was incorrect. CVE-2024-39362 has been rejected: https://lore.kernel.org/lkml/2024070209-tapping-satchel-a949@gregkh/ So I won't backport the fix. Reassigning to the security team. Rejected, closing. |