Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:[EOL][EOL]net: openvswitch: remove never-working support for setting nsh fields[EOL][EOL]The validation of the set(nsh(...)) action is completely wrong.[EOL]It runs through the nsh_key_put_from_nlattr() function that is the[EOL]same function that validates NSH keys for the flow match and the[EOL]push_nsh() action.  However, the set(nsh(...)) has a very different[EOL]memory layout.  Nested attributes in there are doubled in size in[EOL]case of the masked set().  That makes proper validation impossible.[EOL][EOL]There is also confusion in the code between the 'masked' flag, that[EOL]says that the nested attributes are doubled in size containing both[EOL]the value and the mask, and the 'is_mask' that says that the value[EOL]we're parsing is the mask.  This is causing kernel crash on trying to[EOL]write into mask part of the match with SW_FLOW_KEY_PUT() during[EOL]validation, while validate_nsh() doesn't allocate any memory for it:[EOL][EOL]  BUG: kernel NULL pointer dereference, address: 0000000000000018[EOL]  #PF: supervisor read access in kernel mode[EOL]  #PF: error_code(0x0000) - not-present page[EOL]  PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0[EOL]  Oops: Oops: 0000 [#1] SMP NOPTI[EOL]  CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary)[EOL]  RIP: 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch][EOL]  Call Trace:[EOL]   <TASK>[EOL]   validate_nsh+0x60/0x90 [openvswitch][EOL]   validate_set.constprop.0+0x270/0x3c0 [openvswitch][EOL]   __ovs_nla_copy_actions+0x477/0x860 [openvswitch][EOL]   ovs_nla_copy_actions+0x8d/0x100 [openvswitch][EOL]   ovs_packet_cmd_execute+0x1cc/0x310 [openvswitch][EOL]   genl_family_rcv_msg_doit+0xdb/0x130[EOL]   genl_family_rcv_msg+0x14b/0x220[EOL]   genl_rcv_msg+0x47/0xa0[EOL]   netlink_rcv_skb+0x53/0x100[EOL]   genl_rcv+0x24/0x40[EOL]   netlink_unicast+0x280/0x3b0[EOL]   netlink_sendmsg+0x1f7/0x430[EOL]   ____sys_sendmsg+0x36b/0x3a0[EOL]   ___sys_sendmsg+0x87/0xd0[EOL]   __sys_sendmsg+0x6d/0xd0[EOL]   do_syscall_64+0x7b/0x2c0[EOL]   entry_SYSCALL_64_after_hwframe+0x76/0x7e[EOL][EOL]The third issue with this process is that while trying to convert[EOL]the non-masked set into masked one, validate_set() copies and doubles[EOL]the size of the OVS_KEY_ATTR_NSH as if it didn't have any nested[EOL]attributes.  It should be copying each nested attribute and doubling[EOL]them in size independently.  And the process must be properly reversed[EOL]during the conversion back from masked to a non-masked variant during[EOL]the flow dump.[EOL][EOL]In the end, the only two outcomes of trying to use this action are[EOL]either validation failure or a kernel crash.  And if somehow someone[EOL]manages to install a flow with such an action, it will most definitely[EOL]not do what it is supposed to, since all the keys and the masks are[EOL]mixed up.[EOL][EOL]Fixing all the issues is a complex task as it requires re-writing[EOL]most of the validation code.[EOL][EOL]Given that and the fact that this functionality never worked since[EOL]introduction, let's just remove it altogether.  It's better to[EOL]re-introduce it later with a proper implementation instead of trying[EOL]to fix it in stable releases.

CVEs

• CVE-2025-40254