CVE-2024-26596

Siemens ProductCERT Advisory SSA-082556

Description

In the Linux kernel, the following vulnerability has been resolved: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events After the blamed commit, we started doing this dereference for every NETDEV_CHANGEUPPER and NETDEV_PRECHANGEUPPER event in the system. static inline struct dsa_port *dsa_user_to_port(const struct net_device *dev) { struct dsa_user_priv *p = netdev_priv(dev); return p->dp; } Which is obviously bogus, because not all net_devices have a netdev_priv() of type struct dsa_user_priv. But struct dsa_user_priv is fairly small, and p->dp means dereferencing 8 bytes starting with offset 16. Most drivers allocate that much private memory anyway, making our access not fault, and we discard the bogus data quickly afterwards, so this wasn't caught. But the dummy interface is somewhat special in that it calls alloc_netdev() with a priv size of 0. So every netdev_priv() dereference is invalid, and we get this when we emit a NETDEV_PRECHANGEUPPER event with a VLAN as its new upper: $ ip link add dummy1 type dummy $ ip link add link dummy1 name dummy1.100 type vlan id 100 [ 43.309174] ================================================================== [ 43.316456] BUG: KASAN: slab-out-of-bounds in dsa_user_prechangeupper+0x30/0xe8 [ 43.323835] Read of size 8 at addr ffff3f86481d2990 by task ip/374 [ 43.330058] [ 43.342436] Call trace: [ 43.366542] dsa_user_prechangeupper+0x30/0xe8 [ 43.371024] dsa_user_netdevice_event+0xb38/0xee8 [ 43.375768] notifier_call_chain+0xa4/0x210 [ 43.379985] raw_notifier_call_chain+0x24/0x38 [ 43.384464] __netdev_upper_dev_link+0x3ec/0x5d8 [ 43.389120] netdev_upper_dev_link+0x70/0xa8 [ 43.393424] register_vlan_dev+0x1bc/0x310 [ 43.397554] vlan_newlink+0x210/0x248 [ 43.401247] rtnl_newlink+0x9fc/0xe30 [ 43.404942] rtnetlink_rcv_msg+0x378/0x580 Avoid the kernel oops by dereferencing after the type check, as customary.

Source: SIEMENS_ADVISORY CVELISTV5 EUVD

Metrics

Severity

none

212.97

—

no public PoC known

—

0.0

—

15.6 %

Elevated — this CVE ranks above at least 10% of all CVEs scored today.

EPSS score

0.2 %

Low — model estimates < 1% exploitation likelihood.

Published

2021-09-26 00:00 UTC

CWE

—

Affected operating systems

bsd
freebsd / freebsd13.2
bsd
freebsd / freebsd13.3
bsd
freebsd / freebsd14.0
bsd
freebsd / freebsd14.1
bsd
netbsd / netbsd
linux
almalinux / almalinux9.0
linux
amazon / amazon_linux2023.0
linux
amazon / amazon_linux
linux
ubuntu / awsbionic
linux
ubuntu / awsjammy
linux
ubuntu / awsnoble
linux
ubuntu / awsresolute
linux
ubuntu / awsxenial
linux
ubuntu / aws-6.8jammy
linux
ubuntu / aws-hwexenial
linux
ubuntu / azurejammy
linux
ubuntu / azurenoble
linux
ubuntu / azureresolute
linux
ubuntu / azurexenial
linux
ubuntu / azure-4.15bionic
linux
suse / basesystem_module15
linux
debian / debian_linux10.0
linux
debian / debian_linux11.0
linux
debian / debian_linux12.0

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

android
:linux_kernel::0
android
:linux_kernel:Kernel
arista
cloudvision_agni2024.4.0 – 2025.2.2
arista
cloudvision_portal2024.2.0 – 2026.1.0
arista
velocloud_edge4.5.0 – 6.4.1
arista
velocloud_gateway
arista
velocloud_orchestrator
bitnami
java-min1.9.0
bitnami
varnish6.1.0
bitnami
varnish7.4.0
Dell
ECS3.8.1.0-3.8.1.7
Dell
NetWorkervProxy 19.14
Dell
PowerScale OneFSNode Firmware Package 14.1
Dell
Secure Connect GatewayAppliance 5.32.00.18
Dell
Secure Connect Gateway< 5.36.00.16
fixed in 5.36.00.16
Dell
Secure Connect GatewayAppliance <5.32.00.18
gnu
glibc2.35 – 2.37
gnu
glibc
gnupg
libgcrypt1.11.0 – 1.11.3
gnupg
libgcrypt1.12.0 – 1.12.2
gnupg
libgcrypt1.8.8 – 1.10.4
hackage
xz-clib5.6.3
hackage
xz-clib5.6.4
hackage
xz-clib5.8.0

References & sources

Linked CVEs

Show 291 more CVEs

IDCVE-2024-26596