CVE-2024-26707

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()

Syzkaller reported [1] hitting a warning after failing to allocate

resources for skb in hsr_init_skb(). Since a WARN_ONCE() call will

not help much in this case, it might be prudent to switch to

netdev_warn_once(). At the very least it will suppress syzkaller

reports such as [1].

Just in case, use netdev_warn_once() in send_prp_supervision_frame()

for similar reasons.

[1]

HSR: Could not send supervision frame

WARNING: CPU: 1 PID: 85 at net/hsr/hsr_device.c:294 send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294

RIP: 0010:send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294

...

Call Trace:

<IRQ>

hsr_announce+0x114/0x370 net/hsr/hsr_device.c:382

call_timer_fn+0x193/0x590 kernel/time/timer.c:1700

expire_timers kernel/time/timer.c:1751 [inline]

__run_timers+0x764/0xb20 kernel/time/timer.c:2022

run_timer_softirq+0x58/0xd0 kernel/ti

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References