In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: guard flow control update with global_tx_fc in buffer switching mvpp2_bm_switch_buffers() unconditionally calls mvpp2_bm_pool_update_priv_fc() when switching between per-cpu and shared buffer pool modes. This function programs CM3 flow control registers via mvpp2_cm3_read()/mvpp2_cm3_write(), which dereference priv->cm3_base without any NULL check. When the CM3 SRAM resource is not present in the device tree (the third reg entry added by commit 60523583b07c ("dts: marvell: add CM3 SRAM memory to cp11x ethernet device tree")), priv->cm3_base remains NULL and priv->global_tx_fc is false. Any operation that triggers mvpp2_bm_switch_buffers(), for example an MTU change that crosses the jumbo frame threshold, will crash: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits pc : readl+0x0/0x18 lr : mvpp2_cm3_read.isra.0+0x14/0x20 Call trace: readl+0x0/0x18 mvpp2_bm_pool_update_fc+0x40/0x12c mvpp2_bm_pool_update_priv_fc+0x94/0xd8 mvpp2_bm_switch_buffers.isra.0+0x80/0x1c0 mvpp2_change_mtu+0x140/0x380 __dev_set_mtu+0x1c/0x38 dev_set_mtu_ext+0x78/0x118 dev_set_mtu+0x48/0xa8 dev_ifsioc+0x21c/0x43c dev_ioctl+0x2d8/0x42c sock_ioctl+0x314/0x378 Every other flow control call site in the driver already guards hardware access with either priv->global_tx_fc or port->tx_fc. mvpp2_bm_switch_buffers() is the only place that omits this check. Add the missing priv->global_tx_fc guard to both the disable and re-enable calls in mvpp2_bm_switch_buffers(), consistent with the rest of the driver.
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: net: mvpp2: proteger la actualización del control de flujo con global_tx_fc en la conmutación de búferes mvpp2_bm_switch_buffers() llama incondicionalmente a mvpp2_bm_pool_update_priv_fc() al cambiar entre modos de pool de búferes por CPU y compartidos. Esta función programa registros de control de flujo CM3 a través de mvpp2_cm3_read()/mvpp2_cm3_write(), que desreferencian priv -> cm3_base sin ninguna comprobación de NULL. Cuando el recurso CM3 SRAM no está presente en el árbol de dispositivos (la tercera entrada reg añadida por el commit 60523583b07c ('dts: marvell: add CM3 SRAM memory to cp11x ethernet device tree')), priv -> cm3_base permanece NULL y priv -> global_tx_fc es falso. Cualquier operación que active mvpp2_bm_switch_buffers(), por ejemplo, un cambio de MTU que cruza el umbral de trama jumbo, provocará un fallo: No se puede manejar la desreferencia de puntero NULL del kernel en dirección virtual 0000000000000000 Información de aborto de memoria: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits pc : readl+0x0/0x18 lr : mvpp2_cm3_read.isra.0+0x14/0x20 Rastreo de llamadas: readl+0x0/0x18 mvpp2_bm_pool_update_fc+0x40/0x12c mvpp2_bm_pool_update_priv_fc+0x94/0xd8 mvpp2_bm_switch_buffers.isra.0+0x80/0x1c0 mvpp2_change_mtu+0x140/0x380 __dev_set_mtu+0x1c/0x38 dev_set_mtu_ext+0x78/0x118 dev_set_mtu+0x48/0xa8 dev_ifsioc+0x21c/0x43c dev_ioctl+0x2d8/0x42c sock_ioctl+0x314/0x378 Cada otro sitio de llamada de control de flujo en el controlador ya protege el acceso al hardware con priv -> global_tx_fc o port -> tx_fc. mvpp2_bm_switch_buffers() es el único lugar que omite esta comprobación. Añadir la protección priv -> global_tx_fc faltante tanto a las llamadas de deshabilitación como de re-habilitación en mvpp2_bm_switch_buffers(), de forma consistente con el resto del controlador.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-476
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d2424536400> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23beb16780> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23beb17080> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d242a877740> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d239fbdec80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d239fbded40> | Operating System |
| linux | linux_kernel | 5.12 | <built-in method update of dict object at 0x7d23bea89580> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d23beb16800> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d23beb16b40> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d239fbdf400> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d23beb143c0> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d2424537bc0> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d23bea8a180> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d23beb175c0> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.12:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* |