net: openvswitch: fix flow memory leak in ovs_flow_cmd_new (CVE-2023-52977)

Summary

net: openvswitch: fix flow memory leak in ovs_flow_cmd_new

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix flow memory leak in ovs_flow_cmd_new

Syzkaller reports a memory leak of new_flow in ovs_flow_cmd_new() as it is
not freed when an allocation of a key fails.

BUG: memory leak
unreferenced object 0xffff888116668000 (size 632):
comm "syz-executor231", pid 1090, jiffies 4294844701 (age 18.871s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000defa3494>] kmem_cache_zalloc include/linux/slab.h:654 [inline]
[<00000000defa3494>] ovs_flow_alloc+0x19/0x180 net/openvswitch/flow_table.c:77
[<00000000c67d8873>] ovs_flow_cmd_new+0x1de/0xd40 net/openvswitch/datapath.c:957
[<0000000010a539a8>] genl_family_rcv_msg_doit+0x22d/0x330 net/netlink/genetlink.c:739
[<00000000dff3302d>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
[<00000000dff3302d>] genl_rcv_msg+0x328/0x590 net/netlink/genetlink.c:800
[<000000000286dd87>] netlink_rcv_skb+0x153/0x430 net/netlink/af_netlink.c:2515
[<0000000061fed410>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
[<000000009dc0f111>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
[<000000009dc0f111>] netlink_unicast+0x545/0x7f0 net/netlink/af_netlink.c:1339
[<000000004a5ee816>] netlink_sendmsg+0x8e7/0xde0 net/netlink/af_netlink.c:1934
[<00000000482b476f>] soc…

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"4.14.303"},{"fixed":"4.14.306"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.19.270"},{"fixed":"4.19.273"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.4.229"},{"fixed":"5.4.232"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.10.163"},{"fixed":"5.10.168"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.15.86"},{"fixed":"5.15.93"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.1.2"},{"fixed":"6.1.11"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2023-52977 linux Fixed in: 5.10.178-1
Ubuntu UBUNTU-CVE-2023-52977 linux-azure Fixed in: 4.15.0-1165.180~14.04.1

Summary

Original description

Affected packages

Fix status by distribution

References