[LTS 9.2] CVE-2024-26585, CVE-2024-26668 #623
Conversation
jira VULN-8187 cve CVE-2024-26585 commit-author Jakub Kicinski <[email protected]> commit e01e393 upstream-diff No actual difference from the upstream patch, but required manual conflicts resolution due to differences in neighbouring code Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). Reorder scheduling the work before calling complete(). This seems more logical in the first place, as it's the inverse order of what the submitting thread will do. Reported-by: valis <[email protected]> Fixes: a42055e ("net/tls: Add support for async encryption of records for performance") Signed-off-by: Jakub Kicinski <[email protected]> Reviewed-by: Simon Horman <[email protected]> Reviewed-by: Sabrina Dubroca <[email protected]> Signed-off-by: David S. Miller <[email protected]> (cherry picked from commit e01e393) Signed-off-by: Marcin Wcisło <[email protected]>
jira VULN-8197 cve CVE-2024-26668 commit-author Florian Westphal <[email protected]> commit c9d9eb9 upstream-diff Used `limit' struct instead of `priv' because of missing 369b6cb. Also added casts to `u64' where appropriate as inspired by the RH's LTS 9.4 backport of this patch embedded in 270e20b. Reject bogus configs where internal token counter wraps around. This only occurs with very very large requests, such as 17gbyte/s. Its better to reject this rather than having incorrect ratelimit. Fixes: d2168e8 ("netfilter: nft_limit: add per-byte limiting") Signed-off-by: Florian Westphal <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]> (cherry picked from commit c9d9eb9) Signed-off-by: Marcin Wcisło <[email protected]>
CVE-2024-26581This looks like the fun of I'll take a look at this and get back to you on the projected list i'm having some issues with my Please remove the CVE from the summary line, please leave the details though. |
pvts-mat
changed the title
|
I think check-upstream-fixes fails because you did not push your branch locally. I'll fix this tomorrow morning. |
Marchin is an external commiter which must be done from remote forks, only CIQ employees can make a local branch. |
4 participants
[LTS 9.2]
CVE-2024-26581 VULN-8184
CVE-2024-26585 VULN-8187
CVE-2024-26668 VULN-8197
Commits
CVE-2024-26581
The bug doesn't apply to Rocky Linux LTS 9.2
The patch deals with how the
nft_rbtree_gc_elem(…)is called. It fixes the change in f718863 (1), which is not present inciqlts9_2history. The functionnft_rbtree_gc_elem(…)itself was introduced in c9e6978 (2) which is missing fromciqlts9_2history either. From c9e6978's message:It doesn't have any equivalent in the older versions, as it is associated with the changes to the
__nft_rbtree_insert(…)introduced in c9e6978 (2) (the only usage of~nft_rbtree_gc_elem(…)). See the comparative timeline of the affected filenet/netfilter/nft_set_rbtree.c:CVE-2024-26585
bce037a:
CVE-2024-26668
16e1adf:
kABI check: passed
Boot test: passed
boot-test.log
Kselftests: passed relative
Reference
kselftests–ciqlts9_2–run1.log
kselftests–ciqlts9_2–run2.log
Patch
kselftests–ciqlts9_2-CVE-batch-9–run1.log
kselftests–ciqlts9_2-CVE-batch-9–run2.log
Comparison
The tests results for the reference and the patch are the same.