CVE-2024-26898

Description

In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts This patch is against CVE-2023-6270. The description of cve is: A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution. In aoecmd_cfg_pkts(), it always calls dev_put(ifp) when skb initial code is finished. But the net_device ifp will still be used in later tx()->dev_queue_xmit() in kthread. Which means that the dev_put(ifp) should NOT be called in the success path of skb initial code in aoecmd_cfg_pkts(). Otherwise tx() may run into use-after-free because the net_device is freed. This patch removed the dev_put(ifp) in the success path in aoecmd_cfg_pkts(), and added dev_put() after skb xmit in tx().

Gravité et risque d'exploitation

CVE-2024-26898 obtient un score CVSS de 7.8/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.31 %, ce qui la place devant 22.2 % des CVE référencées.

Que faire ?

• Vérifiez si Linux (versions 6.9, <=6.1.*, 7562f876cd93800f2f8c89445f2a563590b24e09, 0, 4.19.311, 6.1.83, 6.7.11, 5.15.153, <74ca3ef68d2f449bc848c0a814cefc487bf755fa, <=5.10.*, <=6.6.*, 6.8.2, 5.4.273, <f98364e926626c678fb4b9004b75cacf92ff0662, <=5.4.*, <=4.19.*, <=6.8.*, <ad80c34944d7175fa1f5c7a55066020002921a99, <2.6.22, 2.6.22, 6.6.23, <079cba4f4e307c69878226fdf5228c20aa1c969c, <eb48680b0255a9e8a9bdc93d6a55b11c31262e62, 5.10.214, <1a54aa506b3b2f31496731039e49778f54eee881, <=*, <=5.15.*, <=6.7.*, <faf0b4c5e00bb680e8e43ac936df24d3f48c8e65, <a16fbb80064634b254520a46395e36b87ca4731e, <7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4) est présent sur votre parc.
• Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
• À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
• Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

• https://git.kernel.org/stable/c/ad80c34944d7175fa1f5c7a55066020002921a99
• https://git.kernel.org/stable/c/1a54aa506b3b2f31496731039e49778f54eee881
• https://git.kernel.org/stable/c/faf0b4c5e00bb680e8e43ac936df24d3f48c8e65
• https://git.kernel.org/stable/c/7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4
• https://git.kernel.org/stable/c/74ca3ef68d2f449bc848c0a814cefc487bf755fa
• https://git.kernel.org/stable/c/eb48680b0255a9e8a9bdc93d6a55b11c31262e62
• https://git.kernel.org/stable/c/079cba4f4e307c69878226fdf5228c20aa1c969c
• https://git.kernel.org/stable/c/a16fbb80064634b254520a46395e36b87ca4731e
• https://git.kernel.org/stable/c/f98364e926626c678fb4b9004b75cacf92ff0662