In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: kTLS, Fix incorrect page refcounting
The kTLS tx handling code is using a mix of getpage() and pagerefinc() APIs to increment the page reference. But on the release path (mlx5ektlstxhandleresyncdumpcomp()), only putpage() is used.
This is an issue when using pages from large folios: the getpage() references are stored on the folio page while the pageref_inc() references are stored directly in the given page. On release the folio page will be dereferenced too many times.
This was found while doing kTLS testing with sendfile() + ZC when the served file was read from NFS on a kernel with NFS large folios support (commit 49b29a573da8 ("nfs: add support for large folios")).
[
{
"id": "CVE-2024-53138-2e77c19f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c"
},
"digest": {
"line_hashes": [
"224697694959534237309763959906284095784",
"334534663742325679899429905342694027303",
"102566216628500099495156713268179530614",
"94044264763152276626438541853800463123",
"55424908385693218828380124765656893127",
"268038375126274934515211899239339817388",
"216414538371847567694559230695492181376",
"281664735537110651407672942936297882772",
"34816883642038384415088392935715748866",
"251020649477532633590934745027955186339",
"59008327953597394210016835624558800688",
"265486439059187763859625362381851938866"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffad2ac8c859c1c1a981fe9c4f7ff925db684a43"
},
{
"id": "CVE-2024-53138-38a3105c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c"
},
"digest": {
"line_hashes": [
"224697694959534237309763959906284095784",
"334534663742325679899429905342694027303",
"102566216628500099495156713268179530614",
"94044264763152276626438541853800463123",
"55424908385693218828380124765656893127",
"268038375126274934515211899239339817388",
"216414538371847567694559230695492181376",
"281664735537110651407672942936297882772",
"34816883642038384415088392935715748866",
"251020649477532633590934745027955186339",
"59008327953597394210016835624558800688",
"129195108739860913346348149603670908731"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2723e8b2cbd486cb96e5a61b22473f7fd62e18df"
},
{
"id": "CVE-2024-53138-53f514b5",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c"
},
"digest": {
"line_hashes": [
"224697694959534237309763959906284095784",
"334534663742325679899429905342694027303",
"102566216628500099495156713268179530614",
"94044264763152276626438541853800463123",
"55424908385693218828380124765656893127",
"268038375126274934515211899239339817388",
"216414538371847567694559230695492181376",
"281664735537110651407672942936297882772",
"34816883642038384415088392935715748866",
"251020649477532633590934745027955186339",
"59008327953597394210016835624558800688",
"70689140742133333535654173294298330073"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0ddb20a748b122ea86003485f7992fa5e84cc95"
},
{
"id": "CVE-2024-53138-634f240f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c"
},
"digest": {
"line_hashes": [
"224697694959534237309763959906284095784",
"334534663742325679899429905342694027303",
"102566216628500099495156713268179530614",
"94044264763152276626438541853800463123",
"55424908385693218828380124765656893127",
"268038375126274934515211899239339817388",
"216414538371847567694559230695492181376",
"281664735537110651407672942936297882772",
"34816883642038384415088392935715748866",
"251020649477532633590934745027955186339",
"59008327953597394210016835624558800688",
"129195108739860913346348149603670908731"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93a14620b97c911489a5b008782f3d9b0c4aeff4"
},
{
"id": "CVE-2024-53138-95defde2",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c"
},
"digest": {
"line_hashes": [
"224697694959534237309763959906284095784",
"334534663742325679899429905342694027303",
"102566216628500099495156713268179530614",
"94044264763152276626438541853800463123",
"55424908385693218828380124765656893127",
"268038375126274934515211899239339817388",
"216414538371847567694559230695492181376",
"281664735537110651407672942936297882772",
"34816883642038384415088392935715748866",
"251020649477532633590934745027955186339",
"59008327953597394210016835624558800688",
"265486439059187763859625362381851938866"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7b97f9e794d8e2bbaa50e1d6c230196fd214b5e"
},
{
"id": "CVE-2024-53138-a49e70bb",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c"
},
"digest": {
"line_hashes": [
"224697694959534237309763959906284095784",
"334534663742325679899429905342694027303",
"102566216628500099495156713268179530614",
"94044264763152276626438541853800463123",
"55424908385693218828380124765656893127",
"268038375126274934515211899239339817388",
"216414538371847567694559230695492181376",
"281664735537110651407672942936297882772",
"34816883642038384415088392935715748866",
"251020649477532633590934745027955186339",
"59008327953597394210016835624558800688",
"129195108739860913346348149603670908731"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@69fbd07f17b0fdaf8970bc705f5bf115c297839d"
},
{
"id": "CVE-2024-53138-b8cfd5c2",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c"
},
"digest": {
"line_hashes": [
"224697694959534237309763959906284095784",
"334534663742325679899429905342694027303",
"102566216628500099495156713268179530614",
"94044264763152276626438541853800463123",
"55424908385693218828380124765656893127",
"268038375126274934515211899239339817388",
"216414538371847567694559230695492181376",
"281664735537110651407672942936297882772",
"34816883642038384415088392935715748866",
"251020649477532633590934745027955186339",
"59008327953597394210016835624558800688",
"129195108739860913346348149603670908731"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd6e972cc5890d91d6749bb48e3912721c4e4b25"
}
]