net/smc: Fix possible leaked pernet namespace in smc_init()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.15.78, 6.0.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix possible leaked pernet namespace in smc_init() In smc_init(), register_pernet_subsys(&smc_net_stat_ops) is called without any error handling. If it fails, registering of &smc_net_ops won't be reverted. And if smc_nl_init() fails, &smc_net_stat_ops itself won't be reverted. This leaves wild ops in subsystem linkedlist and when another module tries to call register_pernet_operations() it triggers page fault: BUG: unable to handle page fault for address: fffffbfff81b964c RIP: 0010:register_pernet_operations+0x1b9/0x5f0 Call Trace: <TASK> register_pernet_subsys+0x29/0x40 ebtables_init+0x58/0x1000 [ebtables] ...
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From 194730a9beb52d2b030ea45e12d94868d4a0e6fd · fixed in 61defd6450a9ef4a1487090449999b0fd83518ef; From 194730a9beb52d2b030ea45e12d94868d4a0e6fd · fixed in c97daf836f7caf81d3144b8cd2b2a51f9bc3bd09; From 194730a9beb52d2b030ea45e12d94868d4a0e6fd · fixed in 62ff373da2534534c55debe6c724c7fe14adb97f
- Linux Linux
5.14
- KernelLinux
From 5.14.0 · fixed in 5.15.78; From 5.16.0 · fixed in 6.0.8