cve-2024-35911
Vulnerability from cvelistv5
Published
2024-05-19 08:35
Modified
2024-08-02 03:21
Severity
Summary
ice: fix memory corruption bug with suspend and rebuild
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/11ff8392943e08a35cb0aa19d638b02db745f170
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1cb7fdb1dfde1aab66780b4ba44dba6402172111
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e40a02f06ceb0e0b0183e0b973ac5dbf8f75edec
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35911",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T17:12:50.504124Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:33:40.868Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:49.027Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e40a02f06ceb0e0b0183e0b973ac5dbf8f75edec"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/11ff8392943e08a35cb0aa19d638b02db745f170"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1cb7fdb1dfde1aab66780b4ba44dba6402172111"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e40a02f06ceb",
              "status": "affected",
              "version": "b3e7b3a6ee92",
              "versionType": "git"
            },
            {
              "lessThan": "11ff8392943e",
              "status": "affected",
              "version": "b3e7b3a6ee92",
              "versionType": "git"
            },
            {
              "lessThan": "1cb7fdb1dfde",
              "status": "affected",
              "version": "b3e7b3a6ee92",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix memory corruption bug with suspend and rebuild\n\nThe ice driver would previously panic after suspend. This is caused\nfrom the driver *only* calling the ice_vsi_free_q_vectors() function by\nitself, when it is suspending. Since commit b3e7b3a6ee92 (\"ice: prevent\nNULL pointer deref during reload\") the driver has zeroed out\nnum_q_vectors, and only restored it in ice_vsi_cfg_def().\n\nThis further causes the ice_rebuild() function to allocate a zero length\nbuffer, after which num_q_vectors is updated, and then the new value of\nnum_q_vectors is used to index into the zero length buffer, which\ncorrupts memory.\n\nThe fix entails making sure all the code referencing num_q_vectors only\ndoes so after it has been reset via ice_vsi_cfg_def().\n\nI didn\u0027t perform a full bisect, but I was able to test against 6.1.77\nkernel and that ice driver works fine for suspend/resume with no panic,\nso sometime since then, this problem was introduced.\n\nAlso clean up an un-needed init of a local variable in the function\nbeing modified.\n\nPANIC from 6.8.0-rc1:\n\n[1026674.915596] PM: suspend exit\n[1026675.664697] ice 0000:17:00.1: PTP reset successful\n[1026675.664707] ice 0000:17:00.1: 2755 msecs passed between update to cached PHC time\n[1026675.667660] ice 0000:b1:00.0: PTP reset successful\n[1026675.675944] ice 0000:b1:00.0: 2832 msecs passed between update to cached PHC time\n[1026677.137733] ixgbe 0000:31:00.0 ens787: NIC Link is Up 1 Gbps, Flow Control: None\n[1026677.190201] BUG: kernel NULL pointer dereference, address: 0000000000000010\n[1026677.192753] ice 0000:17:00.0: PTP reset successful\n[1026677.192764] ice 0000:17:00.0: 4548 msecs passed between update to cached PHC time\n[1026677.197928] #PF: supervisor read access in kernel mode\n[1026677.197933] #PF: error_code(0x0000) - not-present page\n[1026677.197937] PGD 1557a7067 P4D 0\n[1026677.212133] ice 0000:b1:00.1: PTP reset successful\n[1026677.212143] ice 0000:b1:00.1: 4344 msecs passed between update to cached PHC time\n[1026677.212575]\n[1026677.243142] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[1026677.247918] CPU: 23 PID: 42790 Comm: kworker/23:0 Kdump: loaded Tainted: G        W          6.8.0-rc1+ #1\n[1026677.257989] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022\n[1026677.269367] Workqueue: ice ice_service_task [ice]\n[1026677.274592] RIP: 0010:ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice]\n[1026677.281421] Code: 0f 84 3a ff ff ff 41 0f b7 74 ec 02 66 89 b0 22 02 00 00 81 e6 ff 1f 00 00 e8 ec fd ff ff e9 35 ff ff ff 48 8b 43 30 49 63 ed \u003c41\u003e 0f b7 34 24 41 83 c5 01 48 8b 3c e8 66 89 b7 aa 02 00 00 81 e6\n[1026677.300877] RSP: 0018:ff3be62a6399bcc0 EFLAGS: 00010202\n[1026677.306556] RAX: ff28691e28980828 RBX: ff28691e41099828 RCX: 0000000000188000\n[1026677.314148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff28691e41099828\n[1026677.321730] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n[1026677.329311] R10: 0000000000000007 R11: ffffffffffffffc0 R12: 0000000000000010\n[1026677.336896] R13: 0000000000000000 R14: 0000000000000000 R15: ff28691e0eaa81a0\n[1026677.344472] FS:  0000000000000000(0000) GS:ff28693cbffc0000(0000) knlGS:0000000000000000\n[1026677.353000] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[1026677.359195] CR2: 0000000000000010 CR3: 0000000128df4001 CR4: 0000000000771ef0\n[1026677.366779] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[1026677.374369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[1026677.381952] PKRU: 55555554\n[1026677.385116] Call Trace:\n[1026677.388023]  \u003cTASK\u003e\n[1026677.390589]  ? __die+0x20/0x70\n[1026677.394105]  ? page_fault_oops+0x82/0x160\n[1026677.398576]  ? do_user_addr_fault+0x65/0x6a0\n[1026677.403307]  ? exc_page_fault+0x6a/0x150\n[1026677.407694]  ? asm_exc_page_fault+0x22/0x30\n[1026677.412349]  ? ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice]\n[1026677.4186\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:31:07.537Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e40a02f06ceb0e0b0183e0b973ac5dbf8f75edec"
        },
        {
          "url": "https://git.kernel.org/stable/c/11ff8392943e08a35cb0aa19d638b02db745f170"
        },
        {
          "url": "https://git.kernel.org/stable/c/1cb7fdb1dfde1aab66780b4ba44dba6402172111"
        }
      ],
      "title": "ice: fix memory corruption bug with suspend and rebuild",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35911",
    "datePublished": "2024-05-19T08:35:04.299Z",
    "dateReserved": "2024-05-17T13:50:33.121Z",
    "dateUpdated": "2024-08-02T03:21:49.027Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35911\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-19T09:15:11.690\",\"lastModified\":\"2024-05-20T13:00:04.957\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: fix memory corruption bug with suspend and rebuild\\n\\nThe ice driver would previously panic after suspend. This is caused\\nfrom the driver *only* calling the ice_vsi_free_q_vectors() function by\\nitself, when it is suspending. Since commit b3e7b3a6ee92 (\\\"ice: prevent\\nNULL pointer deref during reload\\\") the driver has zeroed out\\nnum_q_vectors, and only restored it in ice_vsi_cfg_def().\\n\\nThis further causes the ice_rebuild() function to allocate a zero length\\nbuffer, after which num_q_vectors is updated, and then the new value of\\nnum_q_vectors is used to index into the zero length buffer, which\\ncorrupts memory.\\n\\nThe fix entails making sure all the code referencing num_q_vectors only\\ndoes so after it has been reset via ice_vsi_cfg_def().\\n\\nI didn\u0027t perform a full bisect, but I was able to test against 6.1.77\\nkernel and that ice driver works fine for suspend/resume with no panic,\\nso sometime since then, this problem was introduced.\\n\\nAlso clean up an un-needed init of a local variable in the function\\nbeing modified.\\n\\nPANIC from 6.8.0-rc1:\\n\\n[1026674.915596] PM: suspend exit\\n[1026675.664697] ice 0000:17:00.1: PTP reset successful\\n[1026675.664707] ice 0000:17:00.1: 2755 msecs passed between update to cached PHC time\\n[1026675.667660] ice 0000:b1:00.0: PTP reset successful\\n[1026675.675944] ice 0000:b1:00.0: 2832 msecs passed between update to cached PHC time\\n[1026677.137733] ixgbe 0000:31:00.0 ens787: NIC Link is Up 1 Gbps, Flow Control: None\\n[1026677.190201] BUG: kernel NULL pointer dereference, address: 0000000000000010\\n[1026677.192753] ice 0000:17:00.0: PTP reset successful\\n[1026677.192764] ice 0000:17:00.0: 4548 msecs passed between update to cached PHC time\\n[1026677.197928] #PF: supervisor read access in kernel mode\\n[1026677.197933] #PF: error_code(0x0000) - not-present page\\n[1026677.197937] PGD 1557a7067 P4D 0\\n[1026677.212133] ice 0000:b1:00.1: PTP reset successful\\n[1026677.212143] ice 0000:b1:00.1: 4344 msecs passed between update to cached PHC time\\n[1026677.212575]\\n[1026677.243142] Oops: 0000 [#1] PREEMPT SMP NOPTI\\n[1026677.247918] CPU: 23 PID: 42790 Comm: kworker/23:0 Kdump: loaded Tainted: G        W          6.8.0-rc1+ #1\\n[1026677.257989] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022\\n[1026677.269367] Workqueue: ice ice_service_task [ice]\\n[1026677.274592] RIP: 0010:ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice]\\n[1026677.281421] Code: 0f 84 3a ff ff ff 41 0f b7 74 ec 02 66 89 b0 22 02 00 00 81 e6 ff 1f 00 00 e8 ec fd ff ff e9 35 ff ff ff 48 8b 43 30 49 63 ed \u003c41\u003e 0f b7 34 24 41 83 c5 01 48 8b 3c e8 66 89 b7 aa 02 00 00 81 e6\\n[1026677.300877] RSP: 0018:ff3be62a6399bcc0 EFLAGS: 00010202\\n[1026677.306556] RAX: ff28691e28980828 RBX: ff28691e41099828 RCX: 0000000000188000\\n[1026677.314148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff28691e41099828\\n[1026677.321730] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\\n[1026677.329311] R10: 0000000000000007 R11: ffffffffffffffc0 R12: 0000000000000010\\n[1026677.336896] R13: 0000000000000000 R14: 0000000000000000 R15: ff28691e0eaa81a0\\n[1026677.344472] FS:  0000000000000000(0000) GS:ff28693cbffc0000(0000) knlGS:0000000000000000\\n[1026677.353000] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[1026677.359195] CR2: 0000000000000010 CR3: 0000000128df4001 CR4: 0000000000771ef0\\n[1026677.366779] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n[1026677.374369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n[1026677.381952] PKRU: 55555554\\n[1026677.385116] Call Trace:\\n[1026677.388023]  \u003cTASK\u003e\\n[1026677.390589]  ? __die+0x20/0x70\\n[1026677.394105]  ? page_fault_oops+0x82/0x160\\n[1026677.398576]  ? do_user_addr_fault+0x65/0x6a0\\n[1026677.403307]  ? exc_page_fault+0x6a/0x150\\n[1026677.407694]  ? asm_exc_page_fault+0x22/0x30\\n[1026677.412349]  ? ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice]\\n[1026677.4186\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: corrige el error de corrupci\u00f3n de memoria con suspensi\u00f3n y reconstrucci\u00f3n. Anteriormente, el controlador ice entraba en p\u00e1nico despu\u00e9s de la suspensi\u00f3n. Esto se debe a que el controlador *solo* llama a la funci\u00f3n ice_vsi_free_q_vectors() por s\u00ed mismo, cuando est\u00e1 suspendida. Desde la confirmaci\u00f3n b3e7b3a6ee92 (\\\"ice: evitar la eliminaci\u00f3n del puntero NULL durante la recarga\\\"), el controlador puso a cero num_q_vectors y solo lo restaur\u00f3 en ice_vsi_cfg_def(). Esto adem\u00e1s hace que la funci\u00f3n ice_rebuild() asigne un b\u00fafer de longitud cero, despu\u00e9s del cual se actualiza num_q_vectors, y luego el nuevo valor de num_q_vectors se usa para indexar en el b\u00fafer de longitud cero, lo que corrompe la memoria. La soluci\u00f3n implica asegurarse de que todo el c\u00f3digo que hace referencia a num_q_vectors solo lo haga despu\u00e9s de que se haya restablecido mediante ice_vsi_cfg_def(). No realic\u00e9 una bisecci\u00f3n completa, pero pude probar con el kernel 6.1.77 y ese controlador Ice funciona bien para suspender/reanudar sin p\u00e1nico, por lo que en alg\u00fan momento desde entonces, se introdujo este problema. Tambi\u00e9n limpie un inicio innecesario de una variable local en la funci\u00f3n que se est\u00e1 modificando. P\u00c1NICO desde 6.8.0-rc1: [1026674.915596] PM: suspender salida [1026675.664697] ice 0000:17:00.1: reinicio de PTP exitoso [1026675.664707] ice 0000:17:00.1: 2755 ms transcurridos entre la actualizaci\u00f3n y el tiempo de PHC en cach\u00e9 [102667 5.667660] ice 0000:b1:00.0: restablecimiento de PTP exitoso [1026675.675944] ice 0000:b1:00.0: 2832 ms transcurridos entre la actualizaci\u00f3n y el tiempo de PHC en cach\u00e9 [1026677.137733] ixgbe 0000:31:00.0 ens787: el enlace de NIC est\u00e1 activo 1 Gbps, control de flujo: Ninguno [1026677.190201] ERROR: desreferencia del puntero NULL del n\u00facleo, direcci\u00f3n: 0000000000000010 [1026677.192753] ice 0000:17:00.0: reinicio de PTP exitoso [1026677.192764] ice 0000:17:00.0: 4548 mseg. entre la actualizaci\u00f3n y el tiempo de PHC en cach\u00e9 [1026677.197928] # PF: acceso de lectura del supervisor en modo kernel [1026677.197933] #PF: error_code(0x0000) - p\u00e1gina no presente [1026677.197937] PGD 1557a7067 P4D 0 [1026677.212133] ice 0000:b1:00.1: reinicio de PTP exitoso [1026677.2 12143] hielo 0000:b1 :00.1: Pasaron 4344 ms entre la actualizaci\u00f3n y el tiempo de PHC en cach\u00e9 [1026677.212575] [1026677.243142] Vaya: 0000 [#1] PREEMPT SMP NOPTI [1026677.247918] CPU: 23 PID: 42790 Comm: kworker/23:0 Kdump: cargado Ta Inted: GW 6.8.0-rc1+ #1 [1026677.257989] Nombre de hardware: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 16/02/2022 [1026677.269367] Cola de trabajo: ice ice_service_tas k [hielo] [1026677.274592] RIP: 0010:ice_vsi_rebuild_set_coalesce +0x130/0x1e0 [ice] [1026677.281421] C\u00f3digo: 0f 84 3a ff ff ff 41 0f b7 74 ec 02 66 89 b0 22 02 00 00 81 e6 ff 1f 00 00 e8 ec fd ff ff e9 35 ff ff 4 8 8b 43 30 49 63 ed \u0026lt;41\u0026gt; 0f b7 34 24 41 83 c5 01 48 8b 3c e8 66 89 b7 aa 02 00 00 81 e6 [1026677.300877] RSP: 0018:ff3be62a6399bcc0 EFLAGS: 2 [1026677.306556] RAX: ff28691e28980828 RBX: ff28691e41099828 RCX: 0000000000188000 [1026677.314148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff28691e41099828 [1026677.321730] RBP: 0000000000 000000 R08: 0000000000000000 R09: 00000000000000000 [1026677.329311] R10: 0000000000000007 R11: ffffffffffffffc0 R12: 0000000000000010 [102 6677.336896] R13: 00000000000000000 R14: 0000000000000000 R15: ff28691e0eaa81a0 [ 1026677.344472] FS: 0000000000000000(0000) GS:ff28693cbffc0000(0000) knlGS:0000000000000000 [1026677.353000] CS: 0010 DS: 0000 ES: 0000 : 0000000080050033 [1026677.359195] CR2: 0000000000000010 CR3: 0000000128df4001 CR4: 0000000000771ef0 [1026677.366779] DR0: 00000000000 00000 DR1: 0000000000000000 DR2: 0000000000000000 [1026677.374369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1026677.3 81952] PKRU: 55555554 [1026677.385116] Seguimiento de llamadas: [1026677.388023]  [1026677.390589] ? __morir+0x20/0x70 [1026677.394105] --truncado--\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/11ff8392943e08a35cb0aa19d638b02db745f170\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1cb7fdb1dfde1aab66780b4ba44dba6402172111\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e40a02f06ceb0e0b0183e0b973ac5dbf8f75edec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.