Bug 1227102 (CVE-2024-39293) - VUL-0: CVE-2024-39293: kernel: revert "xsk: support redirect to any socket bound to the same umem"
Summary: VUL-0: CVE-2024-39293: kernel: revert "xsk: support redirect to any socket bo...
Status: RESOLVED INVALID
Alias: CVE-2024-39293
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/412088/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-39293:5.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-06-26 16:21 UTC by SMASH SMASH
Modified: 2024-06-28 13:30 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-06-26 16:21:01 UTC 
In the Linux kernel, the following vulnerability has been resolved:

Revert "xsk: Support redirect to any socket bound to the same umem"

This reverts commit 2863d665ea41282379f108e4da6c8a2366ba66db.

This patch introduced a potential kernel crash when multiple napi instances
redirect to the same AF_XDP socket. By removing the queue_index check, it is
possible for multiple napi instances to access the Rx ring at the same time,
which will result in a corrupted ring state which can lead to a crash when
flushing the rings in __xsk_flush(). This can happen when the linked list of
sockets to flush gets corrupted by concurrent accesses. A quick and small fix
is not possible, so let us revert this for now.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-39293
https://www.cve.org/CVERecord?id=CVE-2024-39293
https://git.kernel.org/stable/c/19cb40b1064566ea09538289bfcf5bc7ecb9b6f5
https://git.kernel.org/stable/c/7fcf26b315bbb728036da0862de6b335da83dff2
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-39293.mbox
https://bugzilla.redhat.com/show_bug.cgi?id=2294272