Bug 2320632 (CVE-2024-50041) - CVE-2024-50041 kernel: i40e: Fix macvlan leak by synchronizing access to mac_filter_hash
Summary: CVE-2024-50041 kernel: i40e: Fix macvlan leak by synchronizing access to mac_...
Keywords:
Status: NEW
Alias: CVE-2024-50041
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2320883
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-10-21 20:04 UTC by OSIDB Bzimport
Modified: 2024-10-22 13:32 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2024-10-21 20:04:49 UTC
In the Linux kernel, the following vulnerability has been resolved:

i40e: Fix macvlan leak by synchronizing access to mac_filter_hash

This patch addresses a macvlan leak issue in the i40e driver caused by
concurrent access to vsi->mac_filter_hash. The leak occurs when multiple
threads attempt to modify the mac_filter_hash simultaneously, leading to
inconsistent state and potential memory leaks.

To fix this, we now wrap the calls to i40e_del_mac_filter() and zeroing
vf->default_lan_addr.addr with spin_lock/unlock_bh(&vsi->mac_filter_hash_lock),
ensuring atomic operations and preventing concurrent access.

Additionally, we add lockdep_assert_held(&vsi->mac_filter_hash_lock) in
i40e_add_mac_filter() to help catch similar issues in the future.

Reproduction steps:
1. Spawn VFs and configure port vlan on them.
2. Trigger concurrent macvlan operations (e.g., adding and deleting
	portvlan and/or mac filters).
3. Observe the potential memory leak and inconsistent state in the
	mac_filter_hash.

This synchronization ensures the integrity of the mac_filter_hash and prevents
the described leak.

Comment 1 Avinash Hanwate 2024-10-22 09:31:57 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102133-CVE-2024-50041-6118@gregkh/T


Note You need to log in before you can comment on or make changes to this bug.