Skip to content
Heist/ feed
High

ionic: fix use after netif_napi_del()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: ionic: fix use after netif_napi_del() When queues are started, netif_napi_add() and napi_enable() are called. If there are 4 queues and only 3 queues are used for the current configuration, only 3 queues' napi should be registered and enabled. The ionic_qcq_enable() checks whether the .poll pointer is not NULL for enabling only the using queue' napi. Unused queues' napi will not be registered by netif_napi_add(), so the .poll pointer indicates NULL. But it couldn't distinguish whether the napi was unregistered or not because netif_napi_del() doesn't reset the .poll pointer to NULL. So, ionic_qcq_enable() calls napi_enable() for the queue, which was unregistered by netif_napi_del(). Reproducer: ethtool -L rx 1 tx 1 combined 0 ethtool -L rx 0 tx 0 combined 1 ethtool -L rx 0 tx 0 combined 4 Splat looks like: kernel BUG at net/core/dev.c:6666! Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 1057 Comm: kworker/3:3 Not tainted 6.10.0-rc2+ #16 Workqueue: events ionic_lif_deferred_work [ionic] RIP: 0010:napi_enable+0x3b/0x40 Code: 48 89 c2 48 83 e2 f6 80 b9 61 09 00 00 00 74 0d 48 83 bf 60 01 00 00 00 74 03 80 ce 01 f0 4f RSP: 0018:ffffb6ed83227d48 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff97560cda0828 RCX: 0000000000000029 RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff97560cda0a28 RBP: ffffb6ed83227d50 R08: 0000000000000400 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000001

Announced Source revision 1
Original source ↗

CVE-2024-39502

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2024-39502

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
        "lessThan": "0d19267cb150e8f76ade210e16ee820a77f684e7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
        "lessThan": "ff9c2a9426ecf5b9631e9fd74993b357262387d6",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
        "lessThan": "8edd18dab443863e9e48f084e7f123fca3065e4e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
        "lessThan": "60cd714871cd5a683353a355cbb17a685245cf84",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
        "lessThan": "183ebc167a8a19e916b885d4bb61a3491991bfa5",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
        "lessThan": "a87d72b37b9ec2c1e18fe36b09241d8b30334a2e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
        "lessThan": "79f18a41dd056115d685f3b0a419c7cd40055e13",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/pensando/ionic/ionic_lif.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.4"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.4",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.4.279",
        "versionType": "semver",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.221",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.162",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.95",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.35",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.9.6",
        "versionType": "semver",
        "lessThanOrEqual": "6.9.*"
      },
      {
        "status": "unaffected",
        "version": "6.10",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/pensando/ionic/ionic_lif.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2024-39502

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#26633 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement