Описание
In the Linux kernel, the following vulnerability has been resolved: ionic: Fix netdev notifier unregister on failure If register_netdev() fails, then the driver leaks the netdev notifier. Fix this by calling ionic_lif_unregister() on register_netdev() failure. This will also call ionic_lif_unregister_phc() if it has already been registered.
Отчет
A flaw was found in the Linux kernel's Pensando ionic network driver. If register_netdev() fails while an ionic network interface is being initialized, the driver does not unregister its network device notifier (nor an already-registered PTP hardware clock), resulting in a kernel memory leak. Red Hat rates this flaw as having low security impact: the flaw is only reachable on a device-registration error path, requires local privileged access on systems with ionic hardware, and its consequence is limited to gradual kernel memory consumption rather than a direct confidentiality or integrity impact. The kernel and kernel-rt packages in Red Hat Enterprise Linux 9 are affected; the fix has been deferred to a future update because of the low severity and the impractical nature of triggering this path, leaving a residual risk of slow memory growth on systems that repeatedly hit the ionic interface registration failure path. Red Hat Enterprise Linux 6 and 7 are not affected because the flawed code was introduced upstream in kernel version 5.10, later than the kernels shipped in those releases, and the Red Hat Enterprise Linux 8 streams listed on this flaw are out of support scope. The higher CVSS score in the upstream CVEORG record (7.8) differs from Red Hat's rating because that record assumes high confidentiality and integrity impact, whereas this issue is a bounded error-path resource leak, consistent with the lower NIST rating of 5.5.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Out of support scope | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.1 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: ionic: Fix netdev notifier unregister on failure If register_netdev() fails, then the driver leaks the netdev notifier. Fix this by calling ionic_lif_unregister() on register_netdev() failure. This will also call ionic_lif_unregister_phc() if it has already been registered.
In the Linux kernel, the following vulnerability has been resolved: ionic: Fix netdev notifier unregister on failure If register_netdev() fails, then the driver leaks the netdev notifier. Fix this by calling ionic_lif_unregister() on register_netdev() failure. This will also call ionic_lif_unregister_phc() if it has already been registered.
In the Linux kernel, the following vulnerability has been resolved: i ...
In the Linux kernel, the following vulnerability has been resolved: ionic: Fix netdev notifier unregister on failure If register_netdev() fails, then the driver leaks the netdev notifier. Fix this by calling ionic_lif_unregister() on register_netdev() failure. This will also call ionic_lif_unregister_phc() if it has already been registered.
5.1 Medium
CVSS3