CVE-2024-42073

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-42073
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-42073.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-42073
Downstream
Related
Published
2024-07-29T15:52:36Z
Modified
2025-10-14T20:15:26.274856Z
Summary
mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems
Details

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems

The following two shared buffer operations make use of the Shared Buffer Status Register (SBSR):

# devlink sb occupancy snapshot pci/0000:01:00.0 # devlink sb occupancy clearmax pci/0000:01:00.0

The register has two masks of 256 bits to denote on which ingress / egress ports the register should operate on. Spectrum-4 has more than 256 ports, so the register was extended by cited commit with a new 'port_page' field.

However, when filling the register's payload, the driver specifies the ports as absolute numbers and not relative to the first port of the port page, resulting in memory corruptions [1].

Fix by specifying the ports relative to the first port of the port page.

[1] BUG: KASAN: slab-use-after-free in mlxswspsboccsnapshot+0xb6d/0xbc0 Read of size 1 at addr ffff8881068cb00f by task devlink/1566 [...] Call Trace: <TASK> dumpstacklvl+0xc6/0x120 printreport+0xce/0x670 kasanreport+0xd7/0x110 mlxswspsboccsnapshot+0xb6d/0xbc0 mlxswdevlinksboccsnapshot+0x75/0xb0 devlinknlsboccsnapshotdoit+0x1f9/0x2a0 genlfamilyrcvmsgdoit+0x20c/0x300 genlrcvmsg+0x567/0x800 netlinkrcvskb+0x170/0x450 genlrcv+0x2d/0x40 netlinkunicast+0x547/0x830 netlinksendmsg+0x8d4/0xdb0 _syssendto+0x49b/0x510 _x64syssendto+0xe5/0x1c0 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f [...] Allocated by task 1: kasansavestack+0x33/0x60 kasansavetrack+0x14/0x30 _kasankmalloc+0x8f/0xa0 copyverifierstate+0xbc2/0xfb0 docheckcommon+0x2c51/0xc7e0 bpfcheck+0x5107/0x9960 bpfprogload+0xf0e/0x2690 _sysbpf+0x1a61/0x49d0 _x64sysbpf+0x7d/0xc0 dosyscall64+0xc1/0x1d0 entrySYSCALL64after_hwframe+0x77/0x7f

Freed by task 1: kasansavestack+0x33/0x60 kasansavetrack+0x14/0x30 kasansavefreeinfo+0x3b/0x60 poisonslabobject+0x109/0x170 _kasanslabfree+0x14/0x30 kfree+0xca/0x2b0 freeverifierstate+0xce/0x270 docheckcommon+0x4828/0xc7e0 bpfcheck+0x5107/0x9960 bpfprogload+0xf0e/0x2690 _sysbpf+0x1a61/0x49d0 _x64sysbpf+0x7d/0xc0 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f8538aec88b46642553a9ba9efa0952f5958dbed
Fixed
bfa86a96912faa0b6142a918db88cc0c738a769e
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f8538aec88b46642553a9ba9efa0952f5958dbed
Fixed
942901e0fc74ad4b7992ef7ca9336e68d5fd6d36
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f8538aec88b46642553a9ba9efa0952f5958dbed
Fixed
bf8781ede7bd9a37c0fcabca78976e61300b5a1a
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f8538aec88b46642553a9ba9efa0952f5958dbed
Fixed
c28947de2bed40217cf256c5d0d16880054fcf13

Affected versions

v5.*

v5.16
v5.16-rc3
v5.16-rc4
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.17
v5.17-rc1
v5.17-rc2
v5.17-rc3
v5.17-rc4
v5.17-rc5
v5.17-rc6
v5.17-rc7
v5.17-rc8
v5.18
v5.18-rc1
v5.18-rc2
v5.18-rc3
v5.18-rc4
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8

v6.*

v6.0
v6.0-rc1
v6.0-rc2
v6.0-rc3
v6.0-rc4
v6.0-rc5
v6.0-rc6
v6.0-rc7
v6.1
v6.1-rc1
v6.1-rc2
v6.1-rc3
v6.1-rc4
v6.1-rc5
v6.1-rc6
v6.1-rc7
v6.1-rc8
v6.1.1
v6.1.10
v6.1.11
v6.1.12
v6.1.13
v6.1.14
v6.1.15
v6.1.16
v6.1.17
v6.1.18
v6.1.19
v6.1.2
v6.1.20
v6.1.21
v6.1.22
v6.1.23
v6.1.24
v6.1.25
v6.1.26
v6.1.27
v6.1.28
v6.1.29
v6.1.3
v6.1.30
v6.1.31
v6.1.32
v6.1.33
v6.1.34
v6.1.35
v6.1.36
v6.1.37
v6.1.38
v6.1.39
v6.1.4
v6.1.40
v6.1.41
v6.1.42
v6.1.43
v6.1.44
v6.1.45
v6.1.46
v6.1.47
v6.1.48
v6.1.49
v6.1.5
v6.1.50
v6.1.51
v6.1.52
v6.1.53
v6.1.54
v6.1.55
v6.1.56
v6.1.57
v6.1.58
v6.1.59
v6.1.6
v6.1.60
v6.1.61
v6.1.62
v6.1.63
v6.1.64
v6.1.65
v6.1.66
v6.1.67
v6.1.68
v6.1.69
v6.1.7
v6.1.70
v6.1.71
v6.1.72
v6.1.73
v6.1.74
v6.1.75
v6.1.76
v6.1.77
v6.1.78
v6.1.79
v6.1.8
v6.1.80
v6.1.81
v6.1.82
v6.1.83
v6.1.84
v6.1.85
v6.1.86
v6.1.87
v6.1.88
v6.1.89
v6.1.9
v6.1.90
v6.1.91
v6.1.92
v6.1.93
v6.1.94
v6.1.95
v6.1.96
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.2
v6.2-rc1
v6.2-rc2
v6.2-rc3
v6.2-rc4
v6.2-rc5
v6.2-rc6
v6.2-rc7
v6.2-rc8
v6.3
v6.3-rc1
v6.3-rc2
v6.3-rc3
v6.3-rc4
v6.3-rc5
v6.3-rc6
v6.3-rc7
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.21
v6.6.22
v6.6.23
v6.6.24
v6.6.25
v6.6.26
v6.6.27
v6.6.28
v6.6.29
v6.6.3
v6.6.30
v6.6.31
v6.6.32
v6.6.33
v6.6.34
v6.6.35
v6.6.36
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7
v6.9.1
v6.9.2
v6.9.3
v6.9.4
v6.9.5
v6.9.6
v6.9.7

Database specific 

{
    "vanir_signatures": [
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf8781ede7bd9a37c0fcabca78976e61300b5a1a",
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "165688361880750824408705860827472865995",
                    "26937718096808198193549141841293037039",
                    "52133251221378664218152231671291203997",
                    "176915631182903591465040375591919259246",
                    "48392601370673866128974558431011968566",
                    "243008863311696535302036218949831156151",
                    "26914975977354881268469832354862708557",
                    "110727778907292464747587548564159055117",
                    "85896044089255145995898072968393665410",
                    "52189224959443718174827586114776241056",
                    "132885359001889819116310865131695629354",
                    "19570784793969227899600676908135723546",
                    "309961660469345553732773836712376986180",
                    "288067170658814156793883825275075673920",
                    "177087437258319352566871225027547545596",
                    "318572335045382568037085666441592376075",
                    "12635676559791073554132273426984858202",
                    "209114031641244071074558143172482233859",
                    "106218662652893058242863236231897441835",
                    "57406832468633586335113515452802905528",
                    "269234933442753588458474354741257826979",
                    "19407883712375783899537274393171344774",
                    "109460049847815817592633856735222550714",
                    "52189224959443718174827586114776241056",
                    "132885359001889819116310865131695629354",
                    "19570784793969227899600676908135723546",
                    "309961660469345553732773836712376986180",
                    "288067170658814156793883825275075673920",
                    "290230680216910762817055435726333273962",
                    "39096103370015893115608228662903144629"
                ]
            },
            "id": "CVE-2024-42073-0e2d43e5",
            "target": {
                "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf8781ede7bd9a37c0fcabca78976e61300b5a1a",
            "signature_type": "Function",
            "digest": {
                "function_hash": "121846609874856236202854435173792836231",
                "length": 1507.0
            },
            "id": "CVE-2024-42073-162f2446",
            "target": {
                "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c",
                "function": "mlxsw_sp_sb_occ_snapshot"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfa86a96912faa0b6142a918db88cc0c738a769e",
            "signature_type": "Function",
            "digest": {
                "function_hash": "140631445355890531809385535789935150999",
                "length": 1359.0
            },
            "id": "CVE-2024-42073-3c55c3b1",
            "target": {
                "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c",
                "function": "mlxsw_sp_sb_occ_max_clear"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfa86a96912faa0b6142a918db88cc0c738a769e",
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "165688361880750824408705860827472865995",
                    "26937718096808198193549141841293037039",
                    "52133251221378664218152231671291203997",
                    "176915631182903591465040375591919259246",
                    "48392601370673866128974558431011968566",
                    "243008863311696535302036218949831156151",
                    "26914975977354881268469832354862708557",
                    "110727778907292464747587548564159055117",
                    "85896044089255145995898072968393665410",
                    "52189224959443718174827586114776241056",
                    "132885359001889819116310865131695629354",
                    "19570784793969227899600676908135723546",
                    "309961660469345553732773836712376986180",
                    "288067170658814156793883825275075673920",
                    "177087437258319352566871225027547545596",
                    "318572335045382568037085666441592376075",
                    "12635676559791073554132273426984858202",
                    "209114031641244071074558143172482233859",
                    "106218662652893058242863236231897441835",
                    "57406832468633586335113515452802905528",
                    "269234933442753588458474354741257826979",
                    "19407883712375783899537274393171344774",
                    "109460049847815817592633856735222550714",
                    "52189224959443718174827586114776241056",
                    "132885359001889819116310865131695629354",
                    "19570784793969227899600676908135723546",
                    "309961660469345553732773836712376986180",
                    "288067170658814156793883825275075673920",
                    "290230680216910762817055435726333273962",
                    "39096103370015893115608228662903144629"
                ]
            },
            "id": "CVE-2024-42073-57f8d54a",
            "target": {
                "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c28947de2bed40217cf256c5d0d16880054fcf13",
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "165688361880750824408705860827472865995",
                    "26937718096808198193549141841293037039",
                    "52133251221378664218152231671291203997",
                    "176915631182903591465040375591919259246",
                    "48392601370673866128974558431011968566",
                    "243008863311696535302036218949831156151",
                    "26914975977354881268469832354862708557",
                    "110727778907292464747587548564159055117",
                    "85896044089255145995898072968393665410",
                    "52189224959443718174827586114776241056",
                    "132885359001889819116310865131695629354",
                    "19570784793969227899600676908135723546",
                    "309961660469345553732773836712376986180",
                    "288067170658814156793883825275075673920",
                    "177087437258319352566871225027547545596",
                    "318572335045382568037085666441592376075",
                    "12635676559791073554132273426984858202",
                    "209114031641244071074558143172482233859",
                    "106218662652893058242863236231897441835",
                    "57406832468633586335113515452802905528",
                    "269234933442753588458474354741257826979",
                    "19407883712375783899537274393171344774",
                    "109460049847815817592633856735222550714",
                    "52189224959443718174827586114776241056",
                    "132885359001889819116310865131695629354",
                    "19570784793969227899600676908135723546",
                    "309961660469345553732773836712376986180",
                    "288067170658814156793883825275075673920",
                    "290230680216910762817055435726333273962",
                    "39096103370015893115608228662903144629"
                ]
            },
            "id": "CVE-2024-42073-8e0d458e",
            "target": {
                "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c28947de2bed40217cf256c5d0d16880054fcf13",
            "signature_type": "Function",
            "digest": {
                "function_hash": "121846609874856236202854435173792836231",
                "length": 1507.0
            },
            "id": "CVE-2024-42073-a069e666",
            "target": {
                "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c",
                "function": "mlxsw_sp_sb_occ_snapshot"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf8781ede7bd9a37c0fcabca78976e61300b5a1a",
            "signature_type": "Function",
            "digest": {
                "function_hash": "140631445355890531809385535789935150999",
                "length": 1359.0
            },
            "id": "CVE-2024-42073-ad9f61ad",
            "target": {
                "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c",
                "function": "mlxsw_sp_sb_occ_max_clear"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfa86a96912faa0b6142a918db88cc0c738a769e",
            "signature_type": "Function",
            "digest": {
                "function_hash": "121846609874856236202854435173792836231",
                "length": 1507.0
            },
            "id": "CVE-2024-42073-db1c2e28",
            "target": {
                "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c",
                "function": "mlxsw_sp_sb_occ_snapshot"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@942901e0fc74ad4b7992ef7ca9336e68d5fd6d36",
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "165688361880750824408705860827472865995",
                    "26937718096808198193549141841293037039",
                    "52133251221378664218152231671291203997",
                    "176915631182903591465040375591919259246",
                    "48392601370673866128974558431011968566",
                    "243008863311696535302036218949831156151",
                    "26914975977354881268469832354862708557",
                    "110727778907292464747587548564159055117",
                    "85896044089255145995898072968393665410",
                    "52189224959443718174827586114776241056",
                    "132885359001889819116310865131695629354",
                    "19570784793969227899600676908135723546",
                    "309961660469345553732773836712376986180",
                    "288067170658814156793883825275075673920",
                    "177087437258319352566871225027547545596",
                    "318572335045382568037085666441592376075",
                    "12635676559791073554132273426984858202",
                    "209114031641244071074558143172482233859",
                    "106218662652893058242863236231897441835",
                    "57406832468633586335113515452802905528",
                    "269234933442753588458474354741257826979",
                    "19407883712375783899537274393171344774",
                    "109460049847815817592633856735222550714",
                    "52189224959443718174827586114776241056",
                    "132885359001889819116310865131695629354",
                    "19570784793969227899600676908135723546",
                    "309961660469345553732773836712376986180",
                    "288067170658814156793883825275075673920",
                    "290230680216910762817055435726333273962",
                    "39096103370015893115608228662903144629"
                ]
            },
            "id": "CVE-2024-42073-e21ad983",
            "target": {
                "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@942901e0fc74ad4b7992ef7ca9336e68d5fd6d36",
            "signature_type": "Function",
            "digest": {
                "function_hash": "121846609874856236202854435173792836231",
                "length": 1507.0
            },
            "id": "CVE-2024-42073-e9dace71",
            "target": {
                "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c",
                "function": "mlxsw_sp_sb_occ_snapshot"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c28947de2bed40217cf256c5d0d16880054fcf13",
            "signature_type": "Function",
            "digest": {
                "function_hash": "140631445355890531809385535789935150999",
                "length": 1359.0
            },
            "id": "CVE-2024-42073-f3df3c5a",
            "target": {
                "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c",
                "function": "mlxsw_sp_sb_occ_max_clear"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@942901e0fc74ad4b7992ef7ca9336e68d5fd6d36",
            "signature_type": "Function",
            "digest": {
                "function_hash": "140631445355890531809385535789935150999",
                "length": 1359.0
            },
            "id": "CVE-2024-42073-fb1ac815",
            "target": {
                "file": "drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c",
                "function": "mlxsw_sp_sb_occ_max_clear"
            },
            "deprecated": false,
            "signature_version": "v1"
        }
    ]
}

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.17.0
Fixed
6.1.97
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.37
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.9.8