GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-46766 (GCVE-0-2024-46766)

Vulnerability from cvelistv5 – Published: 2024-09-18 07:12 – Updated: 2026-05-11 20:35
VLAI
Title
ice: move netif_queue_set_napi to rtnl-protected sections
Summary
In the Linux kernel, the following vulnerability has been resolved: ice: move netif_queue_set_napi to rtnl-protected sections Currently, netif_queue_set_napi() is called from ice_vsi_rebuild() that is not rtnl-locked when called from the reset. This creates the need to take the rtnl_lock just for a single function and complicates the synchronization with .ndo_bpf. At the same time, there no actual need to fill napi-to-queue information at this exact point. Fill napi-to-queue information when opening the VSI and clear it when the VSI is being closed. Those routines are already rtnl-locked. Also, rewrite napi-to-queue assignment in a way that prevents inclusion of XDP queues, as this leads to out-of-bounds writes, such as one below. [ +0.000004] BUG: KASAN: slab-out-of-bounds in netif_queue_set_napi+0x1c2/0x1e0 [ +0.000012] Write of size 8 at addr ffff889881727c80 by task bash/7047 [ +0.000006] CPU: 24 PID: 7047 Comm: bash Not tainted 6.10.0-rc2+ #2 [ +0.000004] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021 [ +0.000003] Call Trace: [ +0.000003] <TASK> [ +0.000002] dump_stack_lvl+0x60/0x80 [ +0.000007] print_report+0xce/0x630 [ +0.000007] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ +0.000007] ? __virt_addr_valid+0x1c9/0x2c0 [ +0.000005] ? netif_queue_set_napi+0x1c2/0x1e0 [ +0.000003] kasan_report+0xe9/0x120 [ +0.000004] ? netif_queue_set_napi+0x1c2/0x1e0 [ +0.000004] netif_queue_set_napi+0x1c2/0x1e0 [ +0.000005] ice_vsi_close+0x161/0x670 [ice] [ +0.000114] ice_dis_vsi+0x22f/0x270 [ice] [ +0.000095] ice_pf_dis_all_vsi.constprop.0+0xae/0x1c0 [ice] [ +0.000086] ice_prepare_for_reset+0x299/0x750 [ice] [ +0.000087] pci_dev_save_and_disable+0x82/0xd0 [ +0.000006] pci_reset_function+0x12d/0x230 [ +0.000004] reset_store+0xa0/0x100 [ +0.000006] ? __pfx_reset_store+0x10/0x10 [ +0.000002] ? __pfx_mutex_lock+0x10/0x10 [ +0.000004] ? __check_object_size+0x4c1/0x640 [ +0.000007] kernfs_fop_write_iter+0x30b/0x4a0 [ +0.000006] vfs_write+0x5d6/0xdf0 [ +0.000005] ? fd_install+0x180/0x350 [ +0.000005] ? __pfx_vfs_write+0x10/0xA10 [ +0.000004] ? do_fcntl+0x52c/0xcd0 [ +0.000004] ? kasan_save_track+0x13/0x60 [ +0.000003] ? kasan_save_free_info+0x37/0x60 [ +0.000006] ksys_write+0xfa/0x1d0 [ +0.000003] ? __pfx_ksys_write+0x10/0x10 [ +0.000002] ? __x64_sys_fcntl+0x121/0x180 [ +0.000004] ? _raw_spin_lock+0x87/0xe0 [ +0.000005] do_syscall_64+0x80/0x170 [ +0.000007] ? _raw_spin_lock+0x87/0xe0 [ +0.000004] ? __pfx__raw_spin_lock+0x10/0x10 [ +0.000003] ? file_close_fd_locked+0x167/0x230 [ +0.000005] ? syscall_exit_to_user_mode+0x7d/0x220 [ +0.000005] ? do_syscall_64+0x8c/0x170 [ +0.000004] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? fput+0x1a/0x2c0 [ +0.000004] ? filp_close+0x19/0x30 [ +0.000004] ? do_dup2+0x25a/0x4c0 [ +0.000004] ? __x64_sys_dup2+0x6e/0x2e0 [ +0.000002] ? syscall_exit_to_user_mode+0x7d/0x220 [ +0.000004] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? __count_memcg_events+0x113/0x380 [ +0.000005] ? handle_mm_fault+0x136/0x820 [ +0.000005] ? do_user_addr_fault+0x444/0xa80 [ +0.000004] ? clear_bhb_loop+0x25/0x80 [ +0.000004] ? clear_bhb_loop+0x25/0x80 [ +0.000002] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000005] RIP: 0033:0x7f2033593154
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-29 14:42 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 91fdbce7e8d69be255b45bfeb52092629a50e267 , < 2285c2faef19ee08a6bd6754f4c3ec07dceb2889 (git)
Affected: 91fdbce7e8d69be255b45bfeb52092629a50e267 , < 2a5dc090b92cfa5270e20056074241c6db5c9cdd (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.10.10 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46766",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T14:42:30.909081Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T14:42:45.913Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_base.c",
            "drivers/net/ethernet/intel/ice/ice_lib.c",
            "drivers/net/ethernet/intel/ice/ice_lib.h",
            "drivers/net/ethernet/intel/ice/ice_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2285c2faef19ee08a6bd6754f4c3ec07dceb2889",
              "status": "affected",
              "version": "91fdbce7e8d69be255b45bfeb52092629a50e267",
              "versionType": "git"
            },
            {
              "lessThan": "2a5dc090b92cfa5270e20056074241c6db5c9cdd",
              "status": "affected",
              "version": "91fdbce7e8d69be255b45bfeb52092629a50e267",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_base.c",
            "drivers/net/ethernet/intel/ice/ice_lib.c",
            "drivers/net/ethernet/intel/ice/ice_lib.h",
            "drivers/net/ethernet/intel/ice/ice_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.10",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: move netif_queue_set_napi to rtnl-protected sections\n\nCurrently, netif_queue_set_napi() is called from ice_vsi_rebuild() that is\nnot rtnl-locked when called from the reset. This creates the need to take\nthe rtnl_lock just for a single function and complicates the\nsynchronization with .ndo_bpf. At the same time, there no actual need to\nfill napi-to-queue information at this exact point.\n\nFill napi-to-queue information when opening the VSI and clear it when the\nVSI is being closed. Those routines are already rtnl-locked.\n\nAlso, rewrite napi-to-queue assignment in a way that prevents inclusion of\nXDP queues, as this leads to out-of-bounds writes, such as one below.\n\n[  +0.000004] BUG: KASAN: slab-out-of-bounds in netif_queue_set_napi+0x1c2/0x1e0\n[  +0.000012] Write of size 8 at addr ffff889881727c80 by task bash/7047\n[  +0.000006] CPU: 24 PID: 7047 Comm: bash Not tainted 6.10.0-rc2+ #2\n[  +0.000004] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021\n[  +0.000003] Call Trace:\n[  +0.000003]  \u003cTASK\u003e\n[  +0.000002]  dump_stack_lvl+0x60/0x80\n[  +0.000007]  print_report+0xce/0x630\n[  +0.000007]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[  +0.000007]  ? __virt_addr_valid+0x1c9/0x2c0\n[  +0.000005]  ? netif_queue_set_napi+0x1c2/0x1e0\n[  +0.000003]  kasan_report+0xe9/0x120\n[  +0.000004]  ? netif_queue_set_napi+0x1c2/0x1e0\n[  +0.000004]  netif_queue_set_napi+0x1c2/0x1e0\n[  +0.000005]  ice_vsi_close+0x161/0x670 [ice]\n[  +0.000114]  ice_dis_vsi+0x22f/0x270 [ice]\n[  +0.000095]  ice_pf_dis_all_vsi.constprop.0+0xae/0x1c0 [ice]\n[  +0.000086]  ice_prepare_for_reset+0x299/0x750 [ice]\n[  +0.000087]  pci_dev_save_and_disable+0x82/0xd0\n[  +0.000006]  pci_reset_function+0x12d/0x230\n[  +0.000004]  reset_store+0xa0/0x100\n[  +0.000006]  ? __pfx_reset_store+0x10/0x10\n[  +0.000002]  ? __pfx_mutex_lock+0x10/0x10\n[  +0.000004]  ? __check_object_size+0x4c1/0x640\n[  +0.000007]  kernfs_fop_write_iter+0x30b/0x4a0\n[  +0.000006]  vfs_write+0x5d6/0xdf0\n[  +0.000005]  ? fd_install+0x180/0x350\n[  +0.000005]  ? __pfx_vfs_write+0x10/0xA10\n[  +0.000004]  ? do_fcntl+0x52c/0xcd0\n[  +0.000004]  ? kasan_save_track+0x13/0x60\n[  +0.000003]  ? kasan_save_free_info+0x37/0x60\n[  +0.000006]  ksys_write+0xfa/0x1d0\n[  +0.000003]  ? __pfx_ksys_write+0x10/0x10\n[  +0.000002]  ? __x64_sys_fcntl+0x121/0x180\n[  +0.000004]  ? _raw_spin_lock+0x87/0xe0\n[  +0.000005]  do_syscall_64+0x80/0x170\n[  +0.000007]  ? _raw_spin_lock+0x87/0xe0\n[  +0.000004]  ? __pfx__raw_spin_lock+0x10/0x10\n[  +0.000003]  ? file_close_fd_locked+0x167/0x230\n[  +0.000005]  ? syscall_exit_to_user_mode+0x7d/0x220\n[  +0.000005]  ? do_syscall_64+0x8c/0x170\n[  +0.000004]  ? do_syscall_64+0x8c/0x170\n[  +0.000003]  ? do_syscall_64+0x8c/0x170\n[  +0.000003]  ? fput+0x1a/0x2c0\n[  +0.000004]  ? filp_close+0x19/0x30\n[  +0.000004]  ? do_dup2+0x25a/0x4c0\n[  +0.000004]  ? __x64_sys_dup2+0x6e/0x2e0\n[  +0.000002]  ? syscall_exit_to_user_mode+0x7d/0x220\n[  +0.000004]  ? do_syscall_64+0x8c/0x170\n[  +0.000003]  ? __count_memcg_events+0x113/0x380\n[  +0.000005]  ? handle_mm_fault+0x136/0x820\n[  +0.000005]  ? do_user_addr_fault+0x444/0xa80\n[  +0.000004]  ? clear_bhb_loop+0x25/0x80\n[  +0.000004]  ? clear_bhb_loop+0x25/0x80\n[  +0.000002]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[  +0.000005] RIP: 0033:0x7f2033593154"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:35:56.236Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2285c2faef19ee08a6bd6754f4c3ec07dceb2889"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a5dc090b92cfa5270e20056074241c6db5c9cdd"
        }
      ],
      "title": "ice: move netif_queue_set_napi to rtnl-protected sections",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46766",
    "datePublished": "2024-09-18T07:12:25.353Z",
    "dateReserved": "2024-09-11T15:12:18.273Z",
    "dateUpdated": "2026-05-11T20:35:56.236Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46766",
      "date": "2026-09-16",
      "epss": "0.00229",
      "percentile": "0.13829"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.8\", \"versionEndExcluding\": \"6.10.10\", \"matchCriteriaId\": \"4FAFFECB-D55B-4130-801C-AE52B8A6B1BA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0005AEF-856E-47EB-BFE4-90C46899394D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"39889A68-6D34-47A6-82FC-CD0BF23D6754\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: move netif_queue_set_napi to rtnl-protected sections\\n\\nCurrently, netif_queue_set_napi() is called from ice_vsi_rebuild() that is\\nnot rtnl-locked when called from the reset. This creates the need to take\\nthe rtnl_lock just for a single function and complicates the\\nsynchronization with .ndo_bpf. At the same time, there no actual need to\\nfill napi-to-queue information at this exact point.\\n\\nFill napi-to-queue information when opening the VSI and clear it when the\\nVSI is being closed. Those routines are already rtnl-locked.\\n\\nAlso, rewrite napi-to-queue assignment in a way that prevents inclusion of\\nXDP queues, as this leads to out-of-bounds writes, such as one below.\\n\\n[  +0.000004] BUG: KASAN: slab-out-of-bounds in netif_queue_set_napi+0x1c2/0x1e0\\n[  +0.000012] Write of size 8 at addr ffff889881727c80 by task bash/7047\\n[  +0.000006] CPU: 24 PID: 7047 Comm: bash Not tainted 6.10.0-rc2+ #2\\n[  +0.000004] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021\\n[  +0.000003] Call Trace:\\n[  +0.000003]  \u003cTASK\u003e\\n[  +0.000002]  dump_stack_lvl+0x60/0x80\\n[  +0.000007]  print_report+0xce/0x630\\n[  +0.000007]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n[  +0.000007]  ? __virt_addr_valid+0x1c9/0x2c0\\n[  +0.000005]  ? netif_queue_set_napi+0x1c2/0x1e0\\n[  +0.000003]  kasan_report+0xe9/0x120\\n[  +0.000004]  ? netif_queue_set_napi+0x1c2/0x1e0\\n[  +0.000004]  netif_queue_set_napi+0x1c2/0x1e0\\n[  +0.000005]  ice_vsi_close+0x161/0x670 [ice]\\n[  +0.000114]  ice_dis_vsi+0x22f/0x270 [ice]\\n[  +0.000095]  ice_pf_dis_all_vsi.constprop.0+0xae/0x1c0 [ice]\\n[  +0.000086]  ice_prepare_for_reset+0x299/0x750 [ice]\\n[  +0.000087]  pci_dev_save_and_disable+0x82/0xd0\\n[  +0.000006]  pci_reset_function+0x12d/0x230\\n[  +0.000004]  reset_store+0xa0/0x100\\n[  +0.000006]  ? __pfx_reset_store+0x10/0x10\\n[  +0.000002]  ? __pfx_mutex_lock+0x10/0x10\\n[  +0.000004]  ? __check_object_size+0x4c1/0x640\\n[  +0.000007]  kernfs_fop_write_iter+0x30b/0x4a0\\n[  +0.000006]  vfs_write+0x5d6/0xdf0\\n[  +0.000005]  ? fd_install+0x180/0x350\\n[  +0.000005]  ? __pfx_vfs_write+0x10/0xA10\\n[  +0.000004]  ? do_fcntl+0x52c/0xcd0\\n[  +0.000004]  ? kasan_save_track+0x13/0x60\\n[  +0.000003]  ? kasan_save_free_info+0x37/0x60\\n[  +0.000006]  ksys_write+0xfa/0x1d0\\n[  +0.000003]  ? __pfx_ksys_write+0x10/0x10\\n[  +0.000002]  ? __x64_sys_fcntl+0x121/0x180\\n[  +0.000004]  ? _raw_spin_lock+0x87/0xe0\\n[  +0.000005]  do_syscall_64+0x80/0x170\\n[  +0.000007]  ? _raw_spin_lock+0x87/0xe0\\n[  +0.000004]  ? __pfx__raw_spin_lock+0x10/0x10\\n[  +0.000003]  ? file_close_fd_locked+0x167/0x230\\n[  +0.000005]  ? syscall_exit_to_user_mode+0x7d/0x220\\n[  +0.000005]  ? do_syscall_64+0x8c/0x170\\n[  +0.000004]  ? do_syscall_64+0x8c/0x170\\n[  +0.000003]  ? do_syscall_64+0x8c/0x170\\n[  +0.000003]  ? fput+0x1a/0x2c0\\n[  +0.000004]  ? filp_close+0x19/0x30\\n[  +0.000004]  ? do_dup2+0x25a/0x4c0\\n[  +0.000004]  ? __x64_sys_dup2+0x6e/0x2e0\\n[  +0.000002]  ? syscall_exit_to_user_mode+0x7d/0x220\\n[  +0.000004]  ? do_syscall_64+0x8c/0x170\\n[  +0.000003]  ? __count_memcg_events+0x113/0x380\\n[  +0.000005]  ? handle_mm_fault+0x136/0x820\\n[  +0.000005]  ? do_user_addr_fault+0x444/0xa80\\n[  +0.000004]  ? clear_bhb_loop+0x25/0x80\\n[  +0.000004]  ? clear_bhb_loop+0x25/0x80\\n[  +0.000002]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n[  +0.000005] RIP: 0033:0x7f2033593154\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: mover netif_queue_set_napi a secciones protegidas por rtnl Actualmente, netif_queue_set_napi() se llama desde ice_vsi_rebuild() que no est\\u00e1 bloqueado por rtnl cuando se llama desde el reinicio. Esto crea la necesidad de tomar rtnl_lock solo para una \\u00fanica funci\\u00f3n y complica la sincronizaci\\u00f3n con .ndo_bpf. Al mismo tiempo, no hay necesidad real de completar la informaci\\u00f3n de napi a cola en este punto exacto. Complete la informaci\\u00f3n de napi a cola al abrir la VSI y l\\u00edmpiela cuando se cierre la VSI. Esas rutinas ya est\\u00e1n bloqueadas por rtnl. Adem\\u00e1s, reescriba la asignaci\\u00f3n de napi a cola de una manera que evite la inclusi\\u00f3n de colas XDP, ya que esto conduce a escrituras fuera de los l\\u00edmites, como la siguiente. [ +0.000004] ERROR: KASAN: slab-out-of-bounds en netif_queue_set_napi+0x1c2/0x1e0 [ +0.000012] Escritura de tama\\u00f1o 8 en la direcci\\u00f3n ffff889881727c80 por la tarea bash/7047 [ +0.000006] CPU: 24 PID: 7047 Comm: bash No contaminado 6.10.0-rc2+ #2 [ +0.000004] Nombre del hardware: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 26/08/2021 [ +0.000003] Seguimiento de llamadas: [ +0.000003]  [ +0.000002] nivel_pila_volcado+0x60/0x80 [ +0.000007] informe_impresi\\u00f3n+0xce/0x630 [ +0.000007] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ +0.000007] ? __virt_addr_valid+0x1c9/0x2c0 [ +0.000005] ? netif_queue_set_napi+0x1c2/0x1e0 [ +0.000003] informe_kasan+0xe9/0x120 [ +0.000004] ? netif_queue_set_napi+0x1c2/0x1e0 [ +0.000004] netif_queue_set_napi+0x1c2/0x1e0 [ +0.000005] ice_vsi_close+0x161/0x670 [hielo] [ +0.000114] ice_dis_vsi+0x22f/0x270 [hielo] [ +0.000095] ice_pf_dis_all_vsi.constprop.0+0xae/0x1c0 [hielo] [ +0.000086] ice_preparar_para_restablecer+0x299/0x750 [hielo] [ +0.000087] pci_dev_guardar_y_deshabilitar+0x82/0xd0 [ +0.000006] pci_reset_function+0x12d/0x230 [ +0.000004] reset_store+0xa0/0x100 [ +0.000006] ? __pfx_reset_store+0x10/0x10 [ +0.000002] ? __pfx_mutex_lock+0x10/0x10 [ +0.000004] ? __check_object_size+0x4c1/0x640 [ +0.000007] kernfs_fop_write_iter+0x30b/0x4a0 [ +0.000006] vfs_write+0x5d6/0xdf0 [ +0.000005] ? kasan_save_track+0x13/0x60 [ +0.000003] ? kasan_save_free_info+0x37/0x60 [ +0.000006] ksys_write+0xfa/0x1d0 [ +0.000003] ? __pfx_ksys_write+0x10/0x10 [ +0.000002] ? __x64_sys_fcntl+0x121/0x180 [ +0.000004] ? _raw_spin_lock+0x87/0xe0 [ +0.000005] hacer_syscall_64+0x80/0x170 [ +0.000007] ? _raw_spin_lock+0x87/0xe0 [ +0.000004] ? __pfx__raw_spin_lock+0x10/0x10 [ +0.000003] ? cerrar_archivo_fd_bloqueado+0x167/0x230 [ +0.000005] ? salir_syscall_al_modo_usuario+0x7d/0x220 [ +0.000005] ? __x64_sys_dup2+0x6e/0x2e0 [ +0.000002] ? syscall_salir_al_modo_usuario+0x7d/0x220 [ +0.000004] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? __count_memcg_events+0x113/0x380 [ +0.000005] ? handle_mm_fault+0x136/0x820 [ +0.000005] ? do_user_addr_fault+0x444/0xa80 [ +0.000004] ? clear_bhb_loop+0x25/0x80 [ +0.000004] ? borrar_bucle_bhb+0x25/0x80 [ +0.000002] entrada_SYSCALL_64_despu\\u00e9s_de_hwframe+0x76/0x7e [ +0.000005] RIP: 0033:0x7f2033593154\"}]",
      "id": "CVE-2024-46766",
      "lastModified": "2024-09-23T16:15:23.823",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-09-18T08:15:04.760",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/2285c2faef19ee08a6bd6754f4c3ec07dceb2889\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2a5dc090b92cfa5270e20056074241c6db5c9cdd\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46766\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-18T08:15:04.760\",\"lastModified\":\"2026-06-17T07:55:53.383\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: move netif_queue_set_napi to rtnl-protected sections\\n\\nCurrently, netif_queue_set_napi() is called from ice_vsi_rebuild() that is\\nnot rtnl-locked when called from the reset. This creates the need to take\\nthe rtnl_lock just for a single function and complicates the\\nsynchronization with .ndo_bpf. At the same time, there no actual need to\\nfill napi-to-queue information at this exact point.\\n\\nFill napi-to-queue information when opening the VSI and clear it when the\\nVSI is being closed. Those routines are already rtnl-locked.\\n\\nAlso, rewrite napi-to-queue assignment in a way that prevents inclusion of\\nXDP queues, as this leads to out-of-bounds writes, such as one below.\\n\\n[  +0.000004] BUG: KASAN: slab-out-of-bounds in netif_queue_set_napi+0x1c2/0x1e0\\n[  +0.000012] Write of size 8 at addr ffff889881727c80 by task bash/7047\\n[  +0.000006] CPU: 24 PID: 7047 Comm: bash Not tainted 6.10.0-rc2+ #2\\n[  +0.000004] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021\\n[  +0.000003] Call Trace:\\n[  +0.000003]  \u003cTASK\u003e\\n[  +0.000002]  dump_stack_lvl+0x60/0x80\\n[  +0.000007]  print_report+0xce/0x630\\n[  +0.000007]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n[  +0.000007]  ? __virt_addr_valid+0x1c9/0x2c0\\n[  +0.000005]  ? netif_queue_set_napi+0x1c2/0x1e0\\n[  +0.000003]  kasan_report+0xe9/0x120\\n[  +0.000004]  ? netif_queue_set_napi+0x1c2/0x1e0\\n[  +0.000004]  netif_queue_set_napi+0x1c2/0x1e0\\n[  +0.000005]  ice_vsi_close+0x161/0x670 [ice]\\n[  +0.000114]  ice_dis_vsi+0x22f/0x270 [ice]\\n[  +0.000095]  ice_pf_dis_all_vsi.constprop.0+0xae/0x1c0 [ice]\\n[  +0.000086]  ice_prepare_for_reset+0x299/0x750 [ice]\\n[  +0.000087]  pci_dev_save_and_disable+0x82/0xd0\\n[  +0.000006]  pci_reset_function+0x12d/0x230\\n[  +0.000004]  reset_store+0xa0/0x100\\n[  +0.000006]  ? __pfx_reset_store+0x10/0x10\\n[  +0.000002]  ? __pfx_mutex_lock+0x10/0x10\\n[  +0.000004]  ? __check_object_size+0x4c1/0x640\\n[  +0.000007]  kernfs_fop_write_iter+0x30b/0x4a0\\n[  +0.000006]  vfs_write+0x5d6/0xdf0\\n[  +0.000005]  ? fd_install+0x180/0x350\\n[  +0.000005]  ? __pfx_vfs_write+0x10/0xA10\\n[  +0.000004]  ? do_fcntl+0x52c/0xcd0\\n[  +0.000004]  ? kasan_save_track+0x13/0x60\\n[  +0.000003]  ? kasan_save_free_info+0x37/0x60\\n[  +0.000006]  ksys_write+0xfa/0x1d0\\n[  +0.000003]  ? __pfx_ksys_write+0x10/0x10\\n[  +0.000002]  ? __x64_sys_fcntl+0x121/0x180\\n[  +0.000004]  ? _raw_spin_lock+0x87/0xe0\\n[  +0.000005]  do_syscall_64+0x80/0x170\\n[  +0.000007]  ? _raw_spin_lock+0x87/0xe0\\n[  +0.000004]  ? __pfx__raw_spin_lock+0x10/0x10\\n[  +0.000003]  ? file_close_fd_locked+0x167/0x230\\n[  +0.000005]  ? syscall_exit_to_user_mode+0x7d/0x220\\n[  +0.000005]  ? do_syscall_64+0x8c/0x170\\n[  +0.000004]  ? do_syscall_64+0x8c/0x170\\n[  +0.000003]  ? do_syscall_64+0x8c/0x170\\n[  +0.000003]  ? fput+0x1a/0x2c0\\n[  +0.000004]  ? filp_close+0x19/0x30\\n[  +0.000004]  ? do_dup2+0x25a/0x4c0\\n[  +0.000004]  ? __x64_sys_dup2+0x6e/0x2e0\\n[  +0.000002]  ? syscall_exit_to_user_mode+0x7d/0x220\\n[  +0.000004]  ? do_syscall_64+0x8c/0x170\\n[  +0.000003]  ? __count_memcg_events+0x113/0x380\\n[  +0.000005]  ? handle_mm_fault+0x136/0x820\\n[  +0.000005]  ? do_user_addr_fault+0x444/0xa80\\n[  +0.000004]  ? clear_bhb_loop+0x25/0x80\\n[  +0.000004]  ? clear_bhb_loop+0x25/0x80\\n[  +0.000002]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n[  +0.000005] RIP: 0033:0x7f2033593154\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: mover netif_queue_set_napi a secciones protegidas por rtnl Actualmente, netif_queue_set_napi() se llama desde ice_vsi_rebuild() que no est\u00e1 bloqueado por rtnl cuando se llama desde el reinicio. Esto crea la necesidad de tomar rtnl_lock solo para una \u00fanica funci\u00f3n y complica la sincronizaci\u00f3n con .ndo_bpf. Al mismo tiempo, no hay necesidad real de completar la informaci\u00f3n de napi a cola en este punto exacto. Complete la informaci\u00f3n de napi a cola al abrir la VSI y l\u00edmpiela cuando se cierre la VSI. Esas rutinas ya est\u00e1n bloqueadas por rtnl. Adem\u00e1s, reescriba la asignaci\u00f3n de napi a cola de una manera que evite la inclusi\u00f3n de colas XDP, ya que esto conduce a escrituras fuera de los l\u00edmites, como la siguiente. [ +0.000004] ERROR: KASAN: slab-out-of-bounds en netif_queue_set_napi+0x1c2/0x1e0 [ +0.000012] Escritura de tama\u00f1o 8 en la direcci\u00f3n ffff889881727c80 por la tarea bash/7047 [ +0.000006] CPU: 24 PID: 7047 Comm: bash No contaminado 6.10.0-rc2+ #2 [ +0.000004] Nombre del hardware: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 26/08/2021 [ +0.000003] Seguimiento de llamadas: [ +0.000003]  [ +0.000002] nivel_pila_volcado+0x60/0x80 [ +0.000007] informe_impresi\u00f3n+0xce/0x630 [ +0.000007] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ +0.000007] ? __virt_addr_valid+0x1c9/0x2c0 [ +0.000005] ? netif_queue_set_napi+0x1c2/0x1e0 [ +0.000003] informe_kasan+0xe9/0x120 [ +0.000004] ? netif_queue_set_napi+0x1c2/0x1e0 [ +0.000004] netif_queue_set_napi+0x1c2/0x1e0 [ +0.000005] ice_vsi_close+0x161/0x670 [hielo] [ +0.000114] ice_dis_vsi+0x22f/0x270 [hielo] [ +0.000095] ice_pf_dis_all_vsi.constprop.0+0xae/0x1c0 [hielo] [ +0.000086] ice_preparar_para_restablecer+0x299/0x750 [hielo] [ +0.000087] pci_dev_guardar_y_deshabilitar+0x82/0xd0 [ +0.000006] pci_reset_function+0x12d/0x230 [ +0.000004] reset_store+0xa0/0x100 [ +0.000006] ? __pfx_reset_store+0x10/0x10 [ +0.000002] ? __pfx_mutex_lock+0x10/0x10 [ +0.000004] ? __check_object_size+0x4c1/0x640 [ +0.000007] kernfs_fop_write_iter+0x30b/0x4a0 [ +0.000006] vfs_write+0x5d6/0xdf0 [ +0.000005] ? kasan_save_track+0x13/0x60 [ +0.000003] ? kasan_save_free_info+0x37/0x60 [ +0.000006] ksys_write+0xfa/0x1d0 [ +0.000003] ? __pfx_ksys_write+0x10/0x10 [ +0.000002] ? __x64_sys_fcntl+0x121/0x180 [ +0.000004] ? _raw_spin_lock+0x87/0xe0 [ +0.000005] hacer_syscall_64+0x80/0x170 [ +0.000007] ? _raw_spin_lock+0x87/0xe0 [ +0.000004] ? __pfx__raw_spin_lock+0x10/0x10 [ +0.000003] ? cerrar_archivo_fd_bloqueado+0x167/0x230 [ +0.000005] ? salir_syscall_al_modo_usuario+0x7d/0x220 [ +0.000005] ? __x64_sys_dup2+0x6e/0x2e0 [ +0.000002] ? syscall_salir_al_modo_usuario+0x7d/0x220 [ +0.000004] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? __count_memcg_events+0x113/0x380 [ +0.000005] ? handle_mm_fault+0x136/0x820 [ +0.000005] ? do_user_addr_fault+0x444/0xa80 [ +0.000004] ? clear_bhb_loop+0x25/0x80 [ +0.000004] ? borrar_bucle_bhb+0x25/0x80 [ +0.000002] entrada_SYSCALL_64_despu\u00e9s_de_hwframe+0x76/0x7e [ +0.000005] RIP: 0033:0x7f2033593154\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/intel/ice/ice_base.c\",\"drivers/net/ethernet/intel/ice/ice_lib.c\",\"drivers/net/ethernet/intel/ice/ice_lib.h\",\"drivers/net/ethernet/intel/ice/ice_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"91fdbce7e8d69be255b45bfeb52092629a50e267\",\"lessThan\":\"2285c2faef19ee08a6bd6754f4c3ec07dceb2889\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"91fdbce7e8d69be255b45bfeb52092629a50e267\",\"lessThan\":\"2a5dc090b92cfa5270e20056074241c6db5c9cdd\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/intel/ice/ice_base.c\",\"drivers/net/ethernet/intel/ice/ice_lib.c\",\"drivers/net/ethernet/intel/ice/ice_lib.h\",\"drivers/net/ethernet/intel/ice/ice_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.10\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T14:42:30.909081Z\",\"id\":\"CVE-2024-46766\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.10.10\",\"matchCriteriaId\":\"4FAFFECB-D55B-4130-801C-AE52B8A6B1BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2285c2faef19ee08a6bd6754f4c3ec07dceb2889\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2a5dc090b92cfa5270e20056074241c6db5c9cdd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:23:13+00:00",
      "cve": "CVE-2024-46766",
      "id": "CVE-2024-46766",
      "initial_release_date": "2024-09-18T00:00:00+00:00",
      "product_status:known_affected": "136",
      "product_status:known_not_affected": "62",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ice: move netif_queue_set_napi to rtnl-protected sections",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46766.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:58:30Z",
      "cve": "CVE-2024-46766",
      "id": "CVE-2024-46766",
      "initial_release_date": "2024-09-19T03:10:19Z",
      "product_status:known_affected": "398",
      "product_status:known_not_affected": "435",
      "product_status:recommended": "361",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-46766",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-46766.json",
      "version": "63"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46766\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T14:42:30.909081Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T14:42:35.265Z\"}}], \"cna\": {\"title\": \"ice: move netif_queue_set_napi to rtnl-protected sections\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"91fdbce7e8d69be255b45bfeb52092629a50e267\", \"lessThan\": \"2285c2faef19ee08a6bd6754f4c3ec07dceb2889\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"91fdbce7e8d69be255b45bfeb52092629a50e267\", \"lessThan\": \"2a5dc090b92cfa5270e20056074241c6db5c9cdd\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/intel/ice/ice_base.c\", \"drivers/net/ethernet/intel/ice/ice_lib.c\", \"drivers/net/ethernet/intel/ice/ice_lib.h\", \"drivers/net/ethernet/intel/ice/ice_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/intel/ice/ice_base.c\", \"drivers/net/ethernet/intel/ice/ice_lib.c\", \"drivers/net/ethernet/intel/ice/ice_lib.h\", \"drivers/net/ethernet/intel/ice/ice_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2285c2faef19ee08a6bd6754f4c3ec07dceb2889\"}, {\"url\": \"https://git.kernel.org/stable/c/2a5dc090b92cfa5270e20056074241c6db5c9cdd\"}], \"x_generator\": {\"engine\": \"bippy-7c5fe7eed585\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: move netif_queue_set_napi to rtnl-protected sections\\n\\nCurrently, netif_queue_set_napi() is called from ice_vsi_rebuild() that is\\nnot rtnl-locked when called from the reset. This creates the need to take\\nthe rtnl_lock just for a single function and complicates the\\nsynchronization with .ndo_bpf. At the same time, there no actual need to\\nfill napi-to-queue information at this exact point.\\n\\nFill napi-to-queue information when opening the VSI and clear it when the\\nVSI is being closed. Those routines are already rtnl-locked.\\n\\nAlso, rewrite napi-to-queue assignment in a way that prevents inclusion of\\nXDP queues, as this leads to out-of-bounds writes, such as one below.\\n\\n[  +0.000004] BUG: KASAN: slab-out-of-bounds in netif_queue_set_napi+0x1c2/0x1e0\\n[  +0.000012] Write of size 8 at addr ffff889881727c80 by task bash/7047\\n[  +0.000006] CPU: 24 PID: 7047 Comm: bash Not tainted 6.10.0-rc2+ #2\\n[  +0.000004] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021\\n[  +0.000003] Call Trace:\\n[  +0.000003]  \u003cTASK\u003e\\n[  +0.000002]  dump_stack_lvl+0x60/0x80\\n[  +0.000007]  print_report+0xce/0x630\\n[  +0.000007]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n[  +0.000007]  ? __virt_addr_valid+0x1c9/0x2c0\\n[  +0.000005]  ? netif_queue_set_napi+0x1c2/0x1e0\\n[  +0.000003]  kasan_report+0xe9/0x120\\n[  +0.000004]  ? netif_queue_set_napi+0x1c2/0x1e0\\n[  +0.000004]  netif_queue_set_napi+0x1c2/0x1e0\\n[  +0.000005]  ice_vsi_close+0x161/0x670 [ice]\\n[  +0.000114]  ice_dis_vsi+0x22f/0x270 [ice]\\n[  +0.000095]  ice_pf_dis_all_vsi.constprop.0+0xae/0x1c0 [ice]\\n[  +0.000086]  ice_prepare_for_reset+0x299/0x750 [ice]\\n[  +0.000087]  pci_dev_save_and_disable+0x82/0xd0\\n[  +0.000006]  pci_reset_function+0x12d/0x230\\n[  +0.000004]  reset_store+0xa0/0x100\\n[  +0.000006]  ? __pfx_reset_store+0x10/0x10\\n[  +0.000002]  ? __pfx_mutex_lock+0x10/0x10\\n[  +0.000004]  ? __check_object_size+0x4c1/0x640\\n[  +0.000007]  kernfs_fop_write_iter+0x30b/0x4a0\\n[  +0.000006]  vfs_write+0x5d6/0xdf0\\n[  +0.000005]  ? fd_install+0x180/0x350\\n[  +0.000005]  ? __pfx_vfs_write+0x10/0xA10\\n[  +0.000004]  ? do_fcntl+0x52c/0xcd0\\n[  +0.000004]  ? kasan_save_track+0x13/0x60\\n[  +0.000003]  ? kasan_save_free_info+0x37/0x60\\n[  +0.000006]  ksys_write+0xfa/0x1d0\\n[  +0.000003]  ? __pfx_ksys_write+0x10/0x10\\n[  +0.000002]  ? __x64_sys_fcntl+0x121/0x180\\n[  +0.000004]  ? _raw_spin_lock+0x87/0xe0\\n[  +0.000005]  do_syscall_64+0x80/0x170\\n[  +0.000007]  ? _raw_spin_lock+0x87/0xe0\\n[  +0.000004]  ? __pfx__raw_spin_lock+0x10/0x10\\n[  +0.000003]  ? file_close_fd_locked+0x167/0x230\\n[  +0.000005]  ? syscall_exit_to_user_mode+0x7d/0x220\\n[  +0.000005]  ? do_syscall_64+0x8c/0x170\\n[  +0.000004]  ? do_syscall_64+0x8c/0x170\\n[  +0.000003]  ? do_syscall_64+0x8c/0x170\\n[  +0.000003]  ? fput+0x1a/0x2c0\\n[  +0.000004]  ? filp_close+0x19/0x30\\n[  +0.000004]  ? do_dup2+0x25a/0x4c0\\n[  +0.000004]  ? __x64_sys_dup2+0x6e/0x2e0\\n[  +0.000002]  ? syscall_exit_to_user_mode+0x7d/0x220\\n[  +0.000004]  ? do_syscall_64+0x8c/0x170\\n[  +0.000003]  ? __count_memcg_events+0x113/0x380\\n[  +0.000005]  ? handle_mm_fault+0x136/0x820\\n[  +0.000005]  ? do_user_addr_fault+0x444/0xa80\\n[  +0.000004]  ? clear_bhb_loop+0x25/0x80\\n[  +0.000004]  ? clear_bhb_loop+0x25/0x80\\n[  +0.000002]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n[  +0.000005] RIP: 0033:0x7f2033593154\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-04-09T14:51:53.330Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46766\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-09T14:51:53.330Z\", \"dateReserved\": \"2024-09-11T15:12:18.273Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-18T07:12:25.353Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.