Executive brief
A vulnerability in the Linux kernel's DPAA2 network driver could allow a local user to cause a system crash or potentially execute unauthorized actions. The issue stems from how the system handles processor core mapping, which can lead to memory corruption (stack overflow) under certain configurations. This could impact the availability and stability of servers using specific Freescale network hardware.
Technical details
A stack-based out-of-bounds write (CWE-787) exists in the dpaa2-eth driver (drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c) within the Linux kernel. When the kernel is compiled with CONFIG_CPUMASK_OFFSTACK=y, the explicit allocation of 'struct cpumask' on the stack in the update_xps() function can lead to a stack overflow. An attacker with local access could exploit this to cause a denial of service (system crash) or potentially achieve privilege escalation. The fix replaces the stack allocation with the *cpumask_var API, which handles allocation strategy based on kernel configuration.
Affected products
- Linux Linux Kernel up to 5.4.279, 5.5 to 5.10.221, 5.11 to 5.15.162, 5.16 to 6.1.97, 6.2 to 6.6.37, 6.7 to 6.9.8
Timeline
- 2024-07-29: disclosed
- 2024-07-29: advisory
- 2024-07-05: patched
References
- https://git.kernel.org/stable/c/48147337d7efdea6ad6e49f5b8eb894b95868ef0
- https://git.kernel.org/stable/c/5e4f25091e6d06e99a23f724c839a58a8776a527
- https://git.kernel.org/stable/c/69f49527aea12c23b78fb3d0a421950bf44fb4e2
- https://git.kernel.org/stable/c/763896ab62a672d728f5eb10ac90d98c607a8509
- https://git.kernel.org/stable/c/a55afc0f5f20ba30970aaf7271929dc00eee5e7d
- https://git.kernel.org/stable/c/b2262b3be27cee334a2fa175ae3afb53f38fb0b1
- https://git.kernel.org/stable/c/d33fe1714a44ff540629b149d8fab4ac6967585c