cve-2024-42321
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:16
Severity ?
Summary
net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/120f1c857a73e52132e473dee89b340440cb692b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4afbac11f2f629d1e62817c4e210bdfaa7521107
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c5d21aabf1b31a79f228508af33aee83456bc1b0
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/eb03d9826aa646577342a952d658d4598381c035
Impacted products
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42321",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:09:25.850374Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:25.817Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/flow_dissector.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eb03d9826aa646577342a952d658d4598381c035",
              "status": "affected",
              "version": "9b52e3f267a6835efd50ed9002d530666d16a411",
              "versionType": "git"
            },
            {
              "lessThan": "4afbac11f2f629d1e62817c4e210bdfaa7521107",
              "status": "affected",
              "version": "9b52e3f267a6835efd50ed9002d530666d16a411",
              "versionType": "git"
            },
            {
              "lessThan": "c5d21aabf1b31a79f228508af33aee83456bc1b0",
              "status": "affected",
              "version": "9b52e3f267a6835efd50ed9002d530666d16a411",
              "versionType": "git"
            },
            {
              "lessThan": "120f1c857a73e52132e473dee89b340440cb692b",
              "status": "affected",
              "version": "9b52e3f267a6835efd50ed9002d530666d16a411",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/flow_dissector.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: flow_dissector: use DEBUG_NET_WARN_ON_ONCE\n\nThe following splat is easy to reproduce upstream as well as in -stable\nkernels. Florian Westphal provided the following commit:\n\n  d1dab4f71d37 (\"net: add and use __skb_get_hash_symmetric_net\")\n\nbut this complementary fix has been also suggested by Willem de Bruijn\nand it can be easily backported to -stable kernel which consists in\nusing DEBUG_NET_WARN_ON_ONCE instead to silence the following splat\ngiven __skb_get_hash() is used by the nftables tracing infrastructure to\nto identify packets in traces.\n\n[69133.561393] ------------[ cut here ]------------\n[69133.561404] WARNING: CPU: 0 PID: 43576 at net/core/flow_dissector.c:1104 __skb_flow_dissect+0x134f/\n[...]\n[69133.561944] CPU: 0 PID: 43576 Comm: socat Not tainted 6.10.0-rc7+ #379\n[69133.561959] RIP: 0010:__skb_flow_dissect+0x134f/0x2ad0\n[69133.561970] Code: 83 f9 04 0f 84 b3 00 00 00 45 85 c9 0f 84 aa 00 00 00 41 83 f9 02 0f 84 81 fc ff\nff 44 0f b7 b4 24 80 00 00 00 e9 8b f9 ff ff \u003c0f\u003e 0b e9 20 f3 ff ff 41 f6 c6 20 0f 84 e4 ef ff ff 48 8d 7b 12 e8\n[69133.561979] RSP: 0018:ffffc90000006fc0 EFLAGS: 00010246\n[69133.561988] RAX: 0000000000000000 RBX: ffffffff82f33e20 RCX: ffffffff81ab7e19\n[69133.561994] RDX: dffffc0000000000 RSI: ffffc90000007388 RDI: ffff888103a1b418\n[69133.562001] RBP: ffffc90000007310 R08: 0000000000000000 R09: 0000000000000000\n[69133.562007] R10: ffffc90000007388 R11: ffffffff810cface R12: ffff888103a1b400\n[69133.562013] R13: 0000000000000000 R14: ffffffff82f33e2a R15: ffffffff82f33e28\n[69133.562020] FS:  00007f40f7131740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000\n[69133.562027] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[69133.562033] CR2: 00007f40f7346ee0 CR3: 000000015d200001 CR4: 00000000001706f0\n[69133.562040] Call Trace:\n[69133.562044]  \u003cIRQ\u003e\n[69133.562049]  ? __warn+0x9f/0x1a0\n[ 1211.841384]  ? __skb_flow_dissect+0x107e/0x2860\n[...]\n[ 1211.841496]  ? bpf_flow_dissect+0x160/0x160\n[ 1211.841753]  __skb_get_hash+0x97/0x280\n[ 1211.841765]  ? __skb_get_hash_symmetric+0x230/0x230\n[ 1211.841776]  ? mod_find+0xbf/0xe0\n[ 1211.841786]  ? get_stack_info_noinstr+0x12/0xe0\n[ 1211.841798]  ? bpf_ksym_find+0x56/0xe0\n[ 1211.841807]  ? __rcu_read_unlock+0x2a/0x70\n[ 1211.841819]  nft_trace_init+0x1b9/0x1c0 [nf_tables]\n[ 1211.841895]  ? nft_trace_notify+0x830/0x830 [nf_tables]\n[ 1211.841964]  ? get_stack_info+0x2b/0x80\n[ 1211.841975]  ? nft_do_chain_arp+0x80/0x80 [nf_tables]\n[ 1211.842044]  nft_do_chain+0x79c/0x850 [nf_tables]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:16:21.376Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eb03d9826aa646577342a952d658d4598381c035"
        },
        {
          "url": "https://git.kernel.org/stable/c/4afbac11f2f629d1e62817c4e210bdfaa7521107"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5d21aabf1b31a79f228508af33aee83456bc1b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/120f1c857a73e52132e473dee89b340440cb692b"
        }
      ],
      "title": "net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42321",
    "datePublished": "2024-08-17T09:09:33.505Z",
    "dateReserved": "2024-07-30T07:40:12.279Z",
    "dateUpdated": "2024-12-19T09:16:21.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42321\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-17T09:15:11.917\",\"lastModified\":\"2024-08-19T12:59:59.177\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: flow_dissector: use DEBUG_NET_WARN_ON_ONCE\\n\\nThe following splat is easy to reproduce upstream as well as in -stable\\nkernels. Florian Westphal provided the following commit:\\n\\n  d1dab4f71d37 (\\\"net: add and use __skb_get_hash_symmetric_net\\\")\\n\\nbut this complementary fix has been also suggested by Willem de Bruijn\\nand it can be easily backported to -stable kernel which consists in\\nusing DEBUG_NET_WARN_ON_ONCE instead to silence the following splat\\ngiven __skb_get_hash() is used by the nftables tracing infrastructure to\\nto identify packets in traces.\\n\\n[69133.561393] ------------[ cut here ]------------\\n[69133.561404] WARNING: CPU: 0 PID: 43576 at net/core/flow_dissector.c:1104 __skb_flow_dissect+0x134f/\\n[...]\\n[69133.561944] CPU: 0 PID: 43576 Comm: socat Not tainted 6.10.0-rc7+ #379\\n[69133.561959] RIP: 0010:__skb_flow_dissect+0x134f/0x2ad0\\n[69133.561970] Code: 83 f9 04 0f 84 b3 00 00 00 45 85 c9 0f 84 aa 00 00 00 41 83 f9 02 0f 84 81 fc ff\\nff 44 0f b7 b4 24 80 00 00 00 e9 8b f9 ff ff \u003c0f\u003e 0b e9 20 f3 ff ff 41 f6 c6 20 0f 84 e4 ef ff ff 48 8d 7b 12 e8\\n[69133.561979] RSP: 0018:ffffc90000006fc0 EFLAGS: 00010246\\n[69133.561988] RAX: 0000000000000000 RBX: ffffffff82f33e20 RCX: ffffffff81ab7e19\\n[69133.561994] RDX: dffffc0000000000 RSI: ffffc90000007388 RDI: ffff888103a1b418\\n[69133.562001] RBP: ffffc90000007310 R08: 0000000000000000 R09: 0000000000000000\\n[69133.562007] R10: ffffc90000007388 R11: ffffffff810cface R12: ffff888103a1b400\\n[69133.562013] R13: 0000000000000000 R14: ffffffff82f33e2a R15: ffffffff82f33e28\\n[69133.562020] FS:  00007f40f7131740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000\\n[69133.562027] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[69133.562033] CR2: 00007f40f7346ee0 CR3: 000000015d200001 CR4: 00000000001706f0\\n[69133.562040] Call Trace:\\n[69133.562044]  \u003cIRQ\u003e\\n[69133.562049]  ? __warn+0x9f/0x1a0\\n[ 1211.841384]  ? __skb_flow_dissect+0x107e/0x2860\\n[...]\\n[ 1211.841496]  ? bpf_flow_dissect+0x160/0x160\\n[ 1211.841753]  __skb_get_hash+0x97/0x280\\n[ 1211.841765]  ? __skb_get_hash_symmetric+0x230/0x230\\n[ 1211.841776]  ? mod_find+0xbf/0xe0\\n[ 1211.841786]  ? get_stack_info_noinstr+0x12/0xe0\\n[ 1211.841798]  ? bpf_ksym_find+0x56/0xe0\\n[ 1211.841807]  ? __rcu_read_unlock+0x2a/0x70\\n[ 1211.841819]  nft_trace_init+0x1b9/0x1c0 [nf_tables]\\n[ 1211.841895]  ? nft_trace_notify+0x830/0x830 [nf_tables]\\n[ 1211.841964]  ? get_stack_info+0x2b/0x80\\n[ 1211.841975]  ? nft_do_chain_arp+0x80/0x80 [nf_tables]\\n[ 1211.842044]  nft_do_chain+0x79c/0x850 [nf_tables]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE El siguiente s\u00edmbolo es f\u00e1cil de reproducir tanto en n\u00facleos anteriores como en n\u00facleos estables. Florian Westphal proporcion\u00f3 la siguiente confirmaci\u00f3n: d1dab4f71d37 (\\\"net: add and use __skb_get_hash_metric_net\\\") pero Willem de Bruijn tambi\u00e9n sugiri\u00f3 esta soluci\u00f3n complementaria y se puede retroportar f\u00e1cilmente al kernel estable, que consiste en usar DEBUG_NET_WARN_ON_ONCE en lugar de silenciar lo siguiente splat dado __skb_get_hash() es utilizado por la infraestructura de seguimiento de nftables para identificar paquetes en los seguimientos. [69133.561393] ------------[ cortar aqu\u00ed ]------------ [69133.561404] ADVERTENCIA: CPU: 0 PID: 43576 en net/core/flow_dissector.c :1104 __skb_flow_dissect+0x134f/ [...] [69133.561944] CPU: 0 PID: 43576 Comm: socat No contaminado 6.10.0-rc7+ #379 [69133.561959] RIP: 0010:__skb_flow_dissect+0x134f/0x2ad0 133.561970] C\u00f3digo: 83 f9 04 0f 84 b3 00 00 00 45 85 c9 0f 84 aa 00 00 00 41 83 f9 02 0f 84 81 fc ff ff 44 0f b7 b4 24 80 00 00 00 e9 8b f9 ff ff \u0026lt;0f\u0026gt; 0b e9 20 ff ff 41 f6 c6 20 0f 84 e4 ef ff ff 48 8d 7b 12 e8 [69133.561979] RSP: 0018:ffffc90000006fc0 EFLAGS: 00010246 [69133.561988] RAX: 00000000000000000 RBX: ffffffff82f33e20 RCX: ffffffff81ab7e19 [69133.561994] RDX: dffffc0000000000 RSI: ffffc900000007388 RDI: ffff888103a1b418 [69133.562001] RBP: ffffc90000007310 R08: 0000000000000000 R09: 0000000000000000 [69133.562007] R10: ffffc90000007388 R11: fffffff810cface 2: ffff888103a1b400 [69133.562013] R13: 0000000000000000 R14: ffffffff82f33e2a R15: ffffffff82f33e28 [69133.562020] FS: 00007f40f7131740(000 0) GS:ffff888390800000(0000 ) knlGS:0000000000000000 [69133.562027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [69133.562033] CR2: 00007f40f7346ee0 CR3: 5d200001 CR4: 00000000001706f0 [69133.562040] Seguimiento de llamadas: [69133.562044]  [69133.562049] ? __advertir+0x9f/0x1a0 [ 1211.841384] ? __skb_flow_dissect+0x107e/0x2860 [...] [ 1211.841496] ? bpf_flow_dissect+0x160/0x160 [ 1211.841753] __skb_get_hash+0x97/0x280 [ 1211.841765] ? __skb_get_hash_metric+0x230/0x230 [1211.841776]? mod_find+0xbf/0xe0 [1211.841786]? get_stack_info_noinstr+0x12/0xe0 [1211.841798]? bpf_ksym_find+0x56/0xe0 [1211.841807]? __rcu_read_unlock+0x2a/0x70 [1211.841819] nft_trace_init+0x1b9/0x1c0 [nf_tables] [1211.841895]? nft_trace_notify+0x830/0x830 [nf_tables] [1211.841964]? get_stack_info+0x2b/0x80 [1211.841975]? nft_do_chain_arp+0x80/0x80 [nf_tables] [ 1211.842044] nft_do_chain+0x79c/0x850 [nf_tables]\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/120f1c857a73e52132e473dee89b340440cb692b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4afbac11f2f629d1e62817c4e210bdfaa7521107\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c5d21aabf1b31a79f228508af33aee83456bc1b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eb03d9826aa646577342a952d658d4598381c035\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.