Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com
☎ 03 60 47 09 81 - info@securiteinfo.com
In the Linux kernel, the following vulnerability has been resolved:net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupportedRussell King reports that on the ZII dev rev B, deleting a bridge VLANfrom a user port fails with -ENOENT:https://lore.kernel.org/netdev/Z_lQXNP0s5-IiJzd@shell.armlinux.org.uk/This comes from mv88e6xxx_port_vlan_leave() -> mv88e6xxx_mst_put(),which tries to find an MST entry in &chip->msts associated with the SID,but fails and returns -ENOENT as such.But we know that this chip does not support MST at all, so that is notsurprising. The question is why does the guard in mv88e6xxx_mst_put()not exit early: if (!sid) return 0;And the answer seems to be simple: the sid comes from vlan.sid whichsupposedly was previously populated by mv88e6xxx_vtu_get().But some chip->info->ops->vtu_getnext() implementations do not populatevlan.sid, for example see mv88e6185_g1_vtu_getnext(). In that case,later in mv88e6xxx_port_vlan_leave() we are using a garbage sid which isjust residual stack memory.Testing for sid == 0 covers all cases of a non-bridge VLAN or a bridgeVLAN mapped to the default MSTI. For some chips, SID 0 is valid andinstalled by mv88e6xxx_stu_setup(). A chip which does not support theSTU would implicitly only support mapping all VLANs to the default MSTI,so although SID 0 is not valid, it would be sufficient, if we were tozero-initialize the vlan structure, to fix the bug, due to thecoincidence that a test for vlan.sid == 0 already exists and leads tothe same (correct) behavior.Another option which would be sufficient would be to add a test formv88e6xxx_has_stu() inside mv88e6xxx_mst_put(), symmetric to the onewhich already exists in mv88e6xxx_mst_get(). But that placement meansthe caller will have to dereference vlan.sid, which means it will accessuninitialized memory, which is not nice even if it ignores it later.So we end up making both modifications, in order to not rely just on thesid == 0 coincidence, but also to avoid having uninitialized structurefields which might get temporarily accessed.
No PoCs from references.
- https://github.com/w4zu/Debian_security