Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl()

A recent commit has modified the code in __bnxt_reserve_rings() to
set the default RSS indirection table to default only when the number
of RX rings is changing.  While this works for newer firmware that
requires RX ring reservations, it causes the regression on older
firmware not requiring RX ring resrvations (BNXT_NEW_RM() returns
false).

With older firmware, RX ring reservations are not required and so
hw_resc->resv_rx_rings is not always set to the proper value.  The
comparison:

if (old_rx_rings != bp->hw_resc.resv_rx_rings)

in __bnxt_reserve_rings() may be false even when the RX rings are
changing.  This will cause __bnxt_reserve_rings() to skip setting
the default RSS indirection table to default to match the current
number of RX rings.  This may later cause bnxt_fill_hw_rss_tbl() to
use an out-of-range index.

We already have bnxt_check_rss_tbl_no_rmgr() to handle exactly this
scenario.  We just need to move it up in bnxt_need_reserve_rings()
to be called unconditionally when using older firmware.  Without the
fix, if the TX rings are changing, we'll skip the
bnxt_check_rss_tbl_no_rmgr() call and __bnxt_reserve_rings() may also
skip the bnxt_set_dflt_rss_indir_tbl() call for the reason explained
in the last paragraph.  Without setting the default RSS indirection
table to default, it causes the regression:

BUG: KASAN: slab-out-of-bounds in __bnxt_hwrm_vnic_set_rss+0xb79/0xe40
Read of size 2 at addr ffff8881c5809618 by task ethtool/31525
Call Trace:
__bnxt_hwrm_vnic_set_rss+0xb79/0xe40
 bnxt_hwrm_vnic_rss_cfg_p5+0xf7/0x460
 __bnxt_setup_vnic_p5+0x12e/0x270
 __bnxt_open_nic+0x2262/0x2f30
 bnxt_open_nic+0x5d/0xf0
 ethnl_set_channels+0x5d4/0xb30
 ethnl_default_set_doit+0x2f1/0x620

The Linux kernel CVE team has assigned CVE-2024-44933 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.10.4 with commit bc57f879a420 and fixed in 6.10.5 with commit abd573e9ad2b
	Issue introduced in 6.11-rc2 with commit 98ba1d931f61 and fixed in 6.11-rc3 with commit da03f5d1b2c3

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-44933
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/broadcom/bnxt/bnxt.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/abd573e9ad2ba64eaa6418a5f4eec819de28f205
	https://git.kernel.org/stable/c/da03f5d1b2c319a2b74fe76edeadcd8fa5f44376

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix the null pointer dereference to ras_manager

Check ras_manager before using it

The Linux kernel CVE team has assigned CVE-2024-43908 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.4.282 with commit ff5c4eb71ee8
	Fixed in 5.10.224 with commit d81c1eeb333d
	Fixed in 5.15.165 with commit 56e848034cca
	Fixed in 6.1.105 with commit 48cada0ac79e
	Fixed in 6.6.46 with commit b89616333979
	Fixed in 6.10.5 with commit 033187a70ba9
	Fixed in 6.11-rc1 with commit 4c11d30c9557

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-43908
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ff5c4eb71ee8951c789b079f6e948f86708b04ed
	https://git.kernel.org/stable/c/d81c1eeb333d84b3012a91c0500189dc1d71e46c
	https://git.kernel.org/stable/c/56e848034ccabe44e8f22ffcf49db771c17b0d0a
	https://git.kernel.org/stable/c/48cada0ac79e4775236d642e9ec5998a7c7fb7a4
	https://git.kernel.org/stable/c/b89616333979114bb0da5fa40fb6e4a2f5294ca2
	https://git.kernel.org/stable/c/033187a70ba9743c73a810a006816e5553d1e7d4
	https://git.kernel.org/stable/c/4c11d30c95576937c6c35e6f29884761f2dddb43

The Guinness brewery has a long history of innovation, but did you know that it was the birthplace of the t-test? A t-test is usually what underpins a declaration of results being “statistically significant”. Scientific American has a fascinating article all about how the Guinness brewery (and one experimental brewer in particular) brought it into being, with ramifications far beyond that of brewing better beer.

Head brewer William Sealy Gosset developed the technique in the early 1900s as a way to more effectively monitor and control the quality of stout beer. At Guinness, Gosset and other brilliant researchers measured everything they could in their quest to optimize and refine large-scale brewing, but there was a repeated problem. Time and again, existing techniques of analysis were simply not applicable to their gathered data, because sample sizes were too small to work with.

While the concept of statistical significance was not new at the time, Gosset’s significant contribution was finding a way to effectively and economically interpret data in the face of small sample sizes. That contribution was the t-test; a practical and logical approach to dealing with uncertainty.

As mentioned, t-testing had ramifications and applications far beyond that of brewing beer. The basic question of whether to consider one population of results significantly different from another population of results is one that underlies nearly all purposeful scientific inquiry. (If you’re unclear on how exactly the t-test is applied and how it is meaningful, the article in the first link walks through some excellent and practical examples.)

Dublin’s Guinness brewery has a rich heritage of innovation so maybe spare them a thought the next time you indulge in statistical inquiry, or in a modern “nitro brew” style beverage. But if you prefer to keep things ultra-classic, there’s always beer from 1574, Dublin castle-style.

On behalf of the Python Packaging Authority and the pip team, I am pleased to announce that we have just released pip 20.3, a new version of pip. You can install it by running python -m pip install --upgrade pip.

This is an important and disruptive release -- we explained why in a blog post last year. We've even made a video about it.

Highlights

• DISRUPTION: Switch to the new dependency resolver by default. Watch out for changes in handling editable installs, constraints files, and more: https://pip.pypa.io/en/latest/user_guide/#changes-to-the-pip-dependency-resolver-in-20-3-2020

• DEPRECATION: Deprecate support for Python 3.5 (to be removed in pip 21.0).

• DEPRECATION: pip freeze will stop filtering the pip, setuptools, distribute and wheel packages from pip freeze output in a future version. To keep the previous behavior, users should use the new --exclude option.

• Substantial improvements in new resolver for performance, output and error messages, avoiding infinite loops, and support for constraints files.

• Support for PEP 600: Future manylinux Platform Tags for Portable Linux Built Distributions.

• Documentation improvements: Resolver migration guide, quickstart guide, and new documentation theme.

• Add support for MacOS Big Sur compatibility tags.

The new resolver is now on by default for Python 3 users. It is significantly stricter and more consistent when it receives incompatible instructions, and reduces support for certain kinds of constraints files, so some workarounds and workflows may break. Please see our guide on how to test and migrate, and how to report issues. You can use the deprecated (old) resolver, using the flag --use-deprecated=legacy-resolver, until we remove it in the pip 21.0 release in January 2021.

You can find more details (including deprecations and removals) in the changelog.

I have been programming in C and C++ since I was 15 years old. And no, I won’t tell you how long ago that was! I have always loved both languages, and still do, but when the first internal pre-releases of Visual Studio 2013 came out, I selected C# as my prime language. To be honest, I felt like a deserter!

When building and working on operating systems, C and C++ are the dominant languages, but when working with customers building line of business and cloud applications, most are using higher level languages like C#, JavaScript and Java. With that said, I would say that about 25% of customers I work with have some form of legacy C and C++ code in production and while it is often not exposed directly to the Internet, much of it sits right behind a web server. In other words, it’s still in the firing line of attackers. For example, some systems I have reviewed take a web request (ASP.NET, PHP etc.), turn the request data into a proprietary format and shoot it over a socket to a service or daemon written in C or C++ listening on a TCP socket. The C/C++ code then performs some parsing and queuing and shoots the request to a back end system which processes the data and returns the result back up the pipeline.

Of course, there are classes of systems that use C/C++ throughout. For example, many control systems use C/C++ for the core system and use higher level languages, such as C# and Java, for the management systems.

In short, there’s still a great deal of old, crusty C and C++ code out there that is directly or indirectly open to attack.

This code should be updated where possible to improve its security, but this should be done in a way that does not introduce regressions and requires very little engineering effort. I am not saying a customer should spend thousands of hours securing C and C++ code (some should, however!) but there are things that can be done that raise the security bar easily, and this means refactoring the code with an eye on security.

What’s Refactoring?

Refactoring is a process where code is improved in some way without changing how it functions. Refactoring examples including making code more legible or maintainable. The rest of this commentary focuses on refactoring C and C++ code so it is more secure and for C and C++ code, that means reducing the number of potential memory corruption issues in the code.

Memory corruption (also called memory safety) vulnerabilities have long been the bane of C and C++ code and every refactoring idea below attempts to reduce or mitigate many memory corruption issues.

Refactoring Idea #1 - Recompile and Relink

It really could not be simpler. The two main C/C++ toolsets in use today, Microsoft Visual C++ and Gnu gcc, add memory corruption defenses to the compiled and linked code. All you need to do is flip a few compiler and linker flags and the tools will add memory corruption defenses to resulting binary.

For Visual C++ the compiler flags are:

• /GS <More Info>

• /guard:cf <More Info>

And the linker flags are:

• /dynamicbase <More Info>

• /nxcompat <More Info>

• /safeseh <More Info>

The really good news is that for Visual C++ 2015, you don’t need to do anything other than recompiling and linking the code as these switches are enabled by default. With the exception of the /guard flag; that's new in VC++ 2015 and must be set.

Also, add this to a commonly used header, such as stdafx.h

#pragma strict_gs_check(on)

For gcc, you should flip the following switches in the compiler and linker:

CFLAGS="-fPIE -fstack-protector-all"

LDFLAGS="-Wl,-z,now -Wl,-z,relro"

<More Info and More Info>

There is a “downside” to these changes – if there are memory corruption vulnerabilities in the code, there’s a good chance your code will fail if an issue is found during test or when the code is in production. I see this as a good thing because you just found a real security vulnerability with a nice, clean stack trace. Fix the code, the bug has probably been latent for decades and you never knew it.

Refactoring Idea #2 – Replace Insecure C Runtime Functions

There are many C runtime functions that we know are insecure because they don’t constrain how much memory is copied. At Microsoft we banned the use of these functions in new code. The Rogue’s Gallery includes:

• strcpy

• strcat

• sprintf

• strncpy

• strncat

• snprintf

• gets

And many, many more. You are wrong if you think I am going to suggest you dive into the code and manually replace these functions with safer versions. A better option, because we’re trying to keep the work as small as possible, is to have the compiler do the work for you when it can. I wrote about this many years ago. All you need to do is add this to a commonly used header file, such as stdafx.h, and then recompile the code:

#define _CRT_SECURE_CPP_OVERLOAD_STANDARD_NAMES 1

#define _CRT_SECURE_CPP_OVERLOAD_STANDARD_NAMES_MEMORY 1

For gcc, you can use these two settings which do a similar thing.

CFLAGS=" -D_FORTIFY_SOURCE=2 -Wformat"

Refactoring Idea #3 – Focused use of Static Analysis Tools

If you use Visual C++, compile with -analyze and fix any issue that relates to memory safety. We have tuned the tool to find issues with a high degree of confidence, so there should be few false positives.

In my opinion, no code should be check-in with these warnings:

C6001, C6002, C6029, C6054, C6059, C6063, C6064, C6066, C6067, C6101, C6200, C6201, C6255, C6320, C6383, C6385, C6386, C6411, C6412

John Carmack has some interesting things to say about the value of using /analyze.

Refactoring Idea #4 – Stretch a Little

This one is a little bit of work, as you’ll get build failures until you fix all the issues, but if you add this to a common header, it will deprecate the banned C runtime functions. After you have downloaded the header, the line to add is:

#include <banned.h>

If that’s a little too harsh, then at least fix all C4996 warnings; these are warnings that indicate banned functionality and the set is smaller than the list in banned.h.

Summary

The security purists out there are probably saying there is a lot more to do to old legacy C and C++ code than what I outlined and the purists are totally correct. But I would much rather see large swaths of C and C++ code be made somewhat more secure rather than having 0% of the C and C++ out there have nothing done to it. For those that want to go beyond this list, feel free to do so!

While perusing vendor datasheets, have you ever questioned the inclusion of seemingly insignificant latency specifications? Take a look at Arista's line-up, for instance. Their 7500 series chassis lists a port-to-port latency of up to 13 microseconds (that's thirteen thousandths of a millisecond) whereas their "ultra-low latency" 7150 series switches provide sub-microsecond latency.

But who cares? Both values can be roughly translated as "zero" for us wetware-powered humans. (For reference, 8,333 microseconds pass in the time it takes your shiny new 120 Hz HDTV to complete one screen refresh.) So, does anyone really care about such obscenely low latency?

For a certain few organizations involved in high-frequency stock trading, those shaved microseconds can add up to billions of dollars in profit. The New York Times recently published an article titled The Wolf Hunters of Wall Street by Michael Lewis, which reveals how banks have leveraged low network latency to manipulate stock prices in open markets. (Thanks to @priscillaoppy for the tip!)

The increments of time involved were absurdly small: In theory, the fastest travel time, from Katsuyama’s desk in Manhattan to the BATS exchange in Weehawken, N.J., was about two milliseconds, and the slowest, from Katsuyama’s desk to the Nasdaq exchange in Carteret, N.J., was around four milliseconds. In practice, the times could vary much more than that, depending on network traffic, static and glitches in the equipment between any two points. It takes 100 milliseconds to blink quickly — it was hard to believe that a fraction of a blink of an eye could have any real market consequences.

Continue reading · 10 comments