[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"*","versionType":"custom","status":"affected"}]}]

{"timestamp":"2024-09-10T16:08:18.214810Z","id":"CVE-2024-43834","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/core/xdp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3","lessThan":"be9d08ff102df3ac4f66e826ea935cf3af63a4bd","versionType":"git","status":"affected"},{"version":"c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3","lessThan":"6c390ef198aa69795427a5cb5fd7cb4bc7e6cd7a","versionType":"git","status":"affected"},{"version":"c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3","lessThan":"3fc1be360b99baeea15cdee3cf94252cd3a72d26","versionType":"git","status":"affected"},{"version":"c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3","lessThan":"bf0ce5aa5f2525ed1b921ba36de96e458e77f482","versionType":"git","status":"affected"},{"version":"c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3","lessThan":"12144069209eec7f2090ce9afa15acdcc2c2a537","versionType":"git","status":"affected"},{"version":"c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3","lessThan":"59a931c5b732ca5fc2ca727f5a72aeabaafa85ec","versionType":"git","status":"affected"},{"version":"bf22306d92ca59c59dc4aa3bab14768948193d56","versionType":"git","status":"affected"},{"version":"05f646cb2174d1a4e032b60b99097f5c4b522616","versionType":"git","status":"affected"},{"version":"5.3.18","lessThan":"5.4","versionType":"semver","status":"affected"},{"version":"5.4.5","lessThan":"5.5","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/core/xdp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.5","status":"affected"},{"version":"0","lessThan":"5.5","versionType":"semver","status":"unaffected"},{"version":"5.10.224","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.165","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.103","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.44","lessThanOrEq

https://cert-portal.siemens.com/productcert/html/ssa-265688.html

https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html

https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NIST NVD-CWE-noinfo

OR
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.3.18 up to (excluding) 5.4
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.4.5 up to (excluding) 5.5
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 6.1.103
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.44
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.10.3

https://git.kernel.org/stable/c/12144069209eec7f2090ce9afa15acdcc2c2a537 No Types Assigned

https://git.kernel.org/stable/c/12144069209eec7f2090ce9afa15acdcc2c2a537 Patch

https://git.kernel.org/stable/c/3fc1be360b99baeea15cdee3cf94252cd3a72d26 No Types Assigned

https://git.kernel.org/stable/c/3fc1be360b99baeea15cdee3cf94252cd3a72d26 Patch

https://git.kernel.org/stable/c/59a931c5b732ca5fc2ca727f5a72aeabaafa85ec No Types Assigned

https://git.kernel.org/stable/c/59a931c5b732ca5fc2ca727f5a72aeabaafa85ec Patch

https://git.kernel.org/stable/c/6c390ef198aa69795427a5cb5fd7cb4bc7e6cd7a No Types Assigned

https://git.kernel.org/stable/c/6c390ef198aa69795427a5cb5fd7cb4bc7e6cd7a Patch

https://git.kernel.org/stable/c/be9d08ff102df3ac4f66e826ea935cf3af63a4bd No Types Assigned

https://git.kernel.org/stable/c/be9d08ff102df3ac4f66e826ea935cf3af63a4bd Patch

https://git.kernel.org/stable/c/bf0ce5aa5f2525ed1b921ba36de96e458e77f482 No Types Assigned

https://git.kernel.org/stable/c/bf0ce5aa5f2525ed1b921ba36de96e458e77f482 Patch

kernel.org https://git.kernel.org/stable/c/6c390ef198aa69795427a5cb5fd7cb4bc7e6cd7a [No types assigned]

kernel.org https://git.kernel.org/stable/c/be9d08ff102df3ac4f66e826ea935cf3af63a4bd [No types assigned]

In the Linux kernel, the following vulnerability has been resolved:

xdp: fix invalid wait context of page_pool_destroy()

If the driver uses a page pool, it creates a page pool with
page_pool_create().
The reference count of page pool is 1 as default.
A page pool will be destroyed only when a reference count reaches 0.
page_pool_destroy() is used to destroy page pool, it decreases a
reference count.
When a page pool is destroyed, ->disconnect() is called, which is
mem_allocator_disconnect().
This function internally acquires mutex_lock().

If the driver uses XDP, it registers a memory model with
xdp_rxq_info_reg_mem_model().
The xdp_rxq_info_reg_mem_model() internally increases a page pool
reference count if a memory model is a page pool.
Now the reference count is 2.

To destroy a page pool, the driver should call both page_pool_destroy()
and xdp_unreg_mem_model().
The xdp_unreg_mem_model() internally calls page_pool_destroy().
Only page_pool_destroy() decreases a reference count.

If a driver calls page_pool_destroy() then xdp_unreg_mem_model(), we
will face an invalid wait context warning.
Because xdp_unreg_mem_model() calls page_pool_destroy() with
rcu_read_lock().
The page_pool_destroy() internally acquires mutex_lock().

Splat looks like:
=============================
[ BUG: Invalid wait context ]
6.10.0-rc6+ #4 Tainted: G W
-----------------------------
ethtool/1806 is trying to lock:
ffffffff90387b90 (mem_id_lock){+.+.}-{4:4}, at: mem_allocator_disconnect+0x73/0x150
other info that might help us debug this:
context-{5:5}
3 locks held by ethtool/1806:
stack backtrace:
CPU: 0 PID: 1806 Comm: ethtool Tainted: G W 6.10.0-rc6+ #4 f916f41f172891c800f2fed
Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021
Call Trace:
<TASK>
dump_stack_lvl+0x7e/0xc0
__lock_acquire+0x1681/0x4de0
? _printk+0x64/0xe0
? __pfx_mark_lock.part.0+0x10/0x10
? __pfx___lock_acquire+0x10/0x10
lock_acquire+0x1b3/0x580
? mem_allocator_disconnect+0x73/0x150
? __wake_up_klogd.part.0+0x16/0xc0
? __pfx_lock_acquire+0x10

kernel.org https://git.kernel.org/stable/c/12144069209eec7f2090ce9afa15acdcc2c2a537 [No types assigned]

kernel.org https://git.kernel.org/stable/c/3fc1be360b99baeea15cdee3cf94252cd3a72d26 [No types assigned]

kernel.org https://git.kernel.org/stable/c/59a931c5b732ca5fc2ca727f5a72aeabaafa85ec [No types assigned]

kernel.org https://git.kernel.org/stable/c/bf0ce5aa5f2525ed1b921ba36de96e458e77f482 [No types assigned]