In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: CT: Fix null-ptr-deref in add rule err flow
In error flow of mlx5tcctentryaddrule(), in case ctruleadd() callback returns error, zonerule->attr is used uninitiated. Fix it to use attr which has the needed pointer value.
Kernel log: BUG: kernel NULL pointer dereference, address: 0000000000000110 RIP: 0010:mlx5tcctentryaddrule+0x2b1/0x2f0 [mlx5core] … Call Trace: <TASK> ? _die+0x20/0x70 ? pagefaultoops+0x150/0x3e0 ? excpagefault+0x74/0x140 ? asmexcpagefault+0x22/0x30 ? mlx5tcctentryaddrule+0x2b1/0x2f0 [mlx5core] ? mlx5tcctentryaddrule+0x1d5/0x2f0 [mlx5core] mlx5tcctblockflowoffload+0xc6a/0xf90 [mlx5core] ? nfflowoffloadtuple+0xd8/0x190 [nfflowtable] nfflowoffloadtuple+0xd8/0x190 [nfflowtable] flowoffloadworkhandler+0x142/0x320 [nfflowtable] ? finishtaskswitch.isra.0+0x15b/0x2b0 processonework+0x16c/0x320 workerthread+0x28c/0x3a0 ? _pfxworkerthread+0x10/0x10 kthread+0xb8/0xf0 ? _pfxkthread+0x10/0x10 retfromfork+0x2d/0x50 ? _pfxkthread+0x10/0x10 retfromforkasm+0x1a/0x30 </TASK>
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@882f392d9e3649557e71efd78ae20c86039ffb7c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"309762512509674446910826349179503928561",
"245001558712998154193919308866183575818",
"266395337164137904721023274063278361640",
"20381508513857098915717631005216579846"
]
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-53120-0f2fc12c"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c7c70ff8b696cfedba350411dca736361ef9a0f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"309762512509674446910826349179503928561",
"245001558712998154193919308866183575818",
"266395337164137904721023274063278361640",
"20381508513857098915717631005216579846"
]
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-53120-7ac299c9"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6030f8bd7902e9e276a0edc09bf11979e4e2bc2e",
"digest": {
"length": 1880.0,
"function_hash": "245469146673994871139930110188580652659"
},
"target": {
"function": "mlx5_tc_ct_entry_add_rule",
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-53120-8805a6bf"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06dc488a593020bd2f006798557d2a32104d8359",
"digest": {
"threshold": 0.9,
"line_hashes": [
"309762512509674446910826349179503928561",
"245001558712998154193919308866183575818",
"266395337164137904721023274063278361640",
"20381508513857098915717631005216579846"
]
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-53120-956c7c78"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6030f8bd7902e9e276a0edc09bf11979e4e2bc2e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"309762512509674446910826349179503928561",
"245001558712998154193919308866183575818",
"266395337164137904721023274063278361640",
"20381508513857098915717631005216579846"
]
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-53120-c25bb8b1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@882f392d9e3649557e71efd78ae20c86039ffb7c",
"digest": {
"length": 1729.0,
"function_hash": "107515616826659701456379024765022482734"
},
"target": {
"function": "mlx5_tc_ct_entry_add_rule",
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-53120-ccb83b5f"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e99c6873229fe0482e7ceb7d5600e32d623ed9d9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"309762512509674446910826349179503928561",
"245001558712998154193919308866183575818",
"266395337164137904721023274063278361640",
"20381508513857098915717631005216579846"
]
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-53120-d140c5bc"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06dc488a593020bd2f006798557d2a32104d8359",
"digest": {
"length": 1880.0,
"function_hash": "245469146673994871139930110188580652659"
},
"target": {
"function": "mlx5_tc_ct_entry_add_rule",
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-53120-e66d92b5"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e99c6873229fe0482e7ceb7d5600e32d623ed9d9",
"digest": {
"length": 1880.0,
"function_hash": "245469146673994871139930110188580652659"
},
"target": {
"function": "mlx5_tc_ct_entry_add_rule",
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-53120-eb6658ae"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c7c70ff8b696cfedba350411dca736361ef9a0f",
"digest": {
"length": 1880.0,
"function_hash": "245469146673994871139930110188580652659"
},
"target": {
"function": "mlx5_tc_ct_entry_add_rule",
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-53120-efd693b1"
}
]