[USN-7178-1] DPDK vulnerability
[LSN-0108-1] Linux kernel vulnerability
[USN-7178-1] DPDK vulnerability
==========================================================================
Ubuntu Security Notice USN-7178-1
December 19, 2024
dpdk vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
Summary:
DPDK could be made to crash if it received specially crafted network
traffic.
Software Description:
- dpdk: set of libraries for fast packet processing
Details:
It was discovered that DPDK incorrectly handled the Vhost library checksum
offload feature. An malicious guest could possibly use this issue to cause
the hypervisor's vSwitch to crash, resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
dpdk 23.11.2-0ubuntu1.1
Ubuntu 24.04 LTS
dpdk 23.11-1ubuntu0.1
Ubuntu 22.04 LTS
dpdk 21.11.6-0ubuntu0.22.04.2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7178-1
CVE-2024-11614
Package Information:
https://launchpad.net/ubuntu/+source/dpdk/23.11.2-0ubuntu1.1
https://launchpad.net/ubuntu/+source/dpdk/23.11-1ubuntu0.1
https://launchpad.net/ubuntu/+source/dpdk/21.11.6-0ubuntu0.22.04.2
[LSN-0108-1] Linux kernel vulnerability
Linux kernel vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 14.04 LTS
Summary
Several security issues were fixed in the kernel.
Software Description
- linux - Linux kernel
- linux-aws - Linux kernel for Amazon Web Services (AWS) systems
- linux-azure - Linux kernel for Microsoft Azure Cloud systems
- linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems
- linux-gke - Linux kernel for Google Container Engine (GKE) systems
- linux-gkeop - Linux kernel for Google Container Engine (GKE) systems
- linux-ibm - Linux kernel for IBM cloud systems
- linux-oracle - Linux kernel for Oracle Cloud systems
Details
In the Linux kernel, the following vulnerability has been resolved: tls:
fix use-after-free on failed backlog decryption When the decrypt request
goes to the backlog and crypto_aead_decrypt returns -EBUSY,
tls_do_decryption will wait until all async decryptions have completed.
If one of them fails, tls_do_decryption will return -EBADMSG and
tls_decrypt_sg jumps to the error path, releasing all the pages. But the
pages have been passed to the async callback, and have already been
released by tls_decrypt_done. The only true async case is when
crypto_aead_decrypt returns -EINPROGRESS. With -EBUSY, we already waited
so we can tell tls_sw_recvmsg that the data is available for immediate
copy, but we need to notify tls_decrypt_sg (via the new ->async_done
flag) that the memory has already been released. (CVE-2024-26800)
In the Linux kernel, the following vulnerability has been resolved:
inet: inet_defrag: prevent sk release while still in use ip_local_out()
and other functions can pass skb->sk as function argument. If the skb is
a fragment and reassembly happens before such function call returns, the
sk must not be released. This affects skb fragments reassembled via
netfilter or similar modules, e.g. openvswitch or ct_act.c, when run as
part of tx pipeline. Eric Dumazet made an initial analysis of this bug.
Quoting Eric: Calling ip_defrag() in output path is also implying
skb_orphan(), which is buggy because output path relies on sk not
disappearing. A relevant old patch about the issue was : 8282f27449bf
(“inet: frag: Always orphan skbs inside ip_defrag()”) [..
net/ipv4/ip_output.c depends on skb->sk being set, and probably to an
inet socket, not an arbitrary one. If we orphan the packet in ipvlan,
then downstream things like FQ packet scheduler will not work properly.
We need to change ip_defrag() to only use skb_orphan() when really
needed, ie whenever frag_list is going to be used. Eric suggested to
stash sk in fragment queue and made an initial patch. However there is a
problem with this: If skb is refragmented again right after,
ip_do_fragment() will copy head->sk to the new fragments, and sets up
destructor to sock_wfree. IOW, we have no choice but to fix up sk_wmem
accouting to reflect the fully reassembled skb, else wmem will
underflow. This change moves the orphan down into the core, to last
possible moment. As ip_defrag_offset is aliased with sk_buff->sk member,
we must move the offset into the FRAG_CB, else skb->sk gets clobbered.
This allows to delay the orphaning long enough to learn if the skb has
to be queued or if the skb is completing the reasm queue. In the former
case, things work as before, skb is orphaned. This is safe because skb
gets queued/stolen and won’t continue past reasm engine. In the latter
case, we will steal the skb->sk reference, reattach it to the head skb,
and fix up wmem accouting when inet_frag inflates truesize.
(CVE-2024-26921)
In the Linux kernel, the following vulnerability has been resolved: mm:
swap: fix race between free_swap_and_cache() and swapoff() There was
previously a theoretical window where swapoff() could run and teardown a
swap_info_struct while a call to free_swap_and_cache() was running in
another thread. This could cause, amongst other bad possibilities,
swap_page_trans_huge_swapped() (called by free_swap_and_cache()) to
access the freed memory for swap_map. This is a theoretical problem and
I haven’t been able to provoke it from a test case. But there has been
agreement based on code review that this is possible (see link below).
Fix it by using get_swap_device()/put_swap_device(), which will stall
swapoff(). There was an extra check in _swap_info_get() to confirm that
the swap entry was not free. This isn’t present in get_swap_device()
because it doesn’t make sense in general due to the race between getting
the reference and swapoff. So I’ve added an equivalent check directly in
free_swap_and_cache(). Details of how to provoke one possible issue
(thanks to David Hildenbrand for deriving this): –8try_to_unuse() will stop as soon as soon as
si->inuse_pages==0. So the question is: could someone reclaim the folio
and turn si->inuse_pages==0, before we completed
swap_page_trans_huge_swapped(). Imagine the following: 2 MiB folio in
the swapcache. Only 2 subpages are still references by swap entries.
Process 1 still references subpage 0 via swap entry. Process 2 still
references subpage 1 via swap entry. Process 1 quits. Calls
free_swap_and_cache(). -> count == SWAP_HAS_CACHE [then, preempted in
the hypervisor etc.] Process 2 quits. Calls free_swap_and_cache(). ->
count == SWAP_HAS_CACHE Process 2 goes ahead, passes
swap_page_trans_huge_swapped(), and calls __try_to_reclaim_swap().
__try_to_reclaim_swap()->folio_free_swap()->delete_from_swap_cache()->
put_swap_folio()->free_swap_slot()->swapcache_free_entries()->
swap_entry_free()->swap_range_free()-> … WRITE_ONCE(si->inuse_pages,
si->inuse_pages - nr_entries); What stops swapoff to succeed after
process 2 reclaimed the swap cache but before process1 finished its call
to swap_page_trans_huge_swapped()? –8trans During loopback communication, a dangling pointer can be
created in vsk->trans, potentially leading to a Use-After-Free
condition. This issue is resolved by initializing vsk->trans to NULL.
(CVE-2024-50264)
Update instructions
The problem can be corrected by updating your kernel livepatch to the
following versions:
Ubuntu 20.04 LTS
aws - 108.1
aws - 108.2
aws - 108.3
azure - 108.1
azure - 108.2
azure - 108.3
gcp - 108.1
gcp - 108.3
generic - 108.1
generic - 108.2
generic - 108.3
gkeop - 108.1
gkeop - 108.2
gkeop - 108.3
ibm - 108.1
ibm - 108.3
lowlatency - 108.1
lowlatency - 108.2
lowlatency - 108.3
oracle - 108.1
oracle - 108.2
oracle - 108.3
Ubuntu 18.04 LTS
aws - 108.2
azure - 108.2
gcp - 108.2
generic - 108.1
generic - 108.2
generic - 108.3
lowlatency - 108.1
lowlatency - 108.2
lowlatency - 108.3
oracle - 108.2
Ubuntu 16.04 LTS
aws - 108.1
aws - 108.2
azure - 108.2
gcp - 108.1
generic - 108.1
generic - 108.2
lowlatency - 108.1
lowlatency - 108.2
Ubuntu 22.04 LTS
aws - 108.1
aws - 108.3
azure - 108.1
azure - 108.3
gcp - 108.1
gcp - 108.3
generic - 108.1
generic - 108.3
gke - 108.1
gke - 108.3
ibm - 108.1
ibm - 108.3
oracle - 108.1
oracle - 108.3
Ubuntu 14.04 LTS
generic - 108.1
lowlatency - 108.1
Support Information
Livepatches for supported LTS kernels will receive upgrades for a period
of up to 13 months after the build date of the kernel.
Livepatches for supported HWE kernels which are not based on an LTS
kernel version will receive upgrades for a period of up to 9 months
after the build date of the kernel, or until the end of support for that
kernel’s non-LTS distro release version, whichever is sooner.
References
- CVE-2024-26800
- CVE-2024-26921
- CVE-2024-26960
- CVE-2024-27398
- CVE-2024-38630
- CVE-2024-43882
- CVE-2024-50264
