In the Linux kernel, the following vulnerability has been resolved:
ice: fix memory corruption bug with suspend and rebuild
The ice driver would previously panic after suspend. This is caused from the driver *only* calling the ice_vsi_free_q_vectors() function by itself, when it is suspending. Since commit b3e7b3a6ee92 ("ice: prevent NULL pointer deref during reload") the driver has zeroed out num_q_vectors, and only restored it in ice_vsi_cfg_def().
This further causes the ice_rebuild() function to allocate a zero length buffer, after which num_q_vectors is updated, and then the new value of num_q_vectors is used to index into the zero length buffer, which corrupts memory.
The fix entails making sure all the code referencing num_q_vectors only does so after it has been reset via ice_vsi_cfg_def().
I didn't perform a full bisect, but I was able to test against 6.1.77 kernel and that ice driver works fine for suspend/resume with no panic, so sometime since then, this problem was introduced.
Also clean up an un-needed init of a local variable in the function being modified.
PANIC from 6.8.0-rc1:
[1026674.915596] PM: suspend exit [1026675.664697] ice 0000:17:00.1: PTP reset successful [1026675.664707] ice 0000:17:00.1: 2755 msecs passed between update to cached PHC time [1026675.667660] ice 0000:b1:00.0: PTP reset successful [1026675.675944] ice 0000:b1:00.0: 2832 msecs passed between update to cached PHC time [1026677.137733] ixgbe 0000:31:00.0 ens787: NIC Link is Up 1 Gbps, Flow Control: None [1026677.190201] BUG: kernel NULL pointer dereference, address: 0000000000000010 [1026677.192753] ice 0000:17:00.0: PTP reset successful [1026677.192764] ice 0000:17:00.0: 4548 msecs passed between update to cached PHC time [1026677.197928] #PF: supervisor read access in kernel mode [1026677.197933] #PF: error_code(0x0000) - not-present page [1026677.197937] PGD 1557a7067 P4D 0 [1026677.212133] ice 0000:b1:00.1: PTP reset successful [1026677.212143] ice 0000:b1:00.1: 4344 msecs passed between update to cached PHC time [1026677.212575] [1026677.243142] Oops: 0000 [#1] PREEMPT SMP NOPTI [1026677.247918] CPU: 23 PID: 42790 Comm: kworker/23:0 Kdump: loaded Tainted: G W 6.8.0-rc1+ #1 [1026677.257989] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022 [1026677.269367] Workqueue: ice ice_service_task [ice] [1026677.274592] RIP: 0010:ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice] [1026677.281421] Code: 0f 84 3a ff ff ff 41 0f b7 74 ec 02 66 89 b0 22 02 00 00 81 e6 ff 1f 00 00 e8 ec fd ff ff e9 35 ff ff ff 48 8b 43 30 49 63 ed <41> 0f b7 34 24 41 83 c5 01 48 8b 3c e8 66 89 b7 aa 02 00 00 81 e6 [1026677.300877] RSP: 0018:ff3be62a6399bcc0 EFLAGS: 00010202 [1026677.306556] RAX: ff28691e28980828 RBX: ff28691e41099828 RCX: 0000000000188000 [1026677.314148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff28691e41099828 [1026677.321730] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [1026677.329311] R10: 0000000000000007 R11: ffffffffffffffc0 R12: 0000000000000010 [1026677.336896] R13: 0000000000000000 R14: 0000000000000000 R15: ff28691e0eaa81a0 [1026677.344472] FS: 0000000000000000(0000) GS:ff28693cbffc0000(0000) knlGS:0000000000000000 [1026677.353000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1026677.359195] CR2: 0000000000000010 CR3: 0000000128df4001 CR4: 0000000000771ef0 [1026677.366779] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1026677.374369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1026677.381952] PKRU: 55555554 [1026677.385116] Call Trace: [1026677.388023] <TASK> [1026677.390589] ? __die+0x20/0x70 [1026677.394105] ? page_fault_oops+0x82/0x160 [1026677.398576] ? do_user_addr_fault+0x65/0x6a0 [1026677.403307] ? exc_page_fault+0x6a/0x150 [1026677.407694] ? asm_exc_page_fault+0x22/0x30 [1026677.412349] ? ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice] [1026677.4186 ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-modules-extraUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-64k-debugUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-toolsUpgrade rvUpgrade kernel-rt-modules-extraUpgrade kernel-64k-devel-matchedUpgrade kernel-abi-stablelistsUpgrade kernel-docUpgrade kernel-rt-modulesUpgrade kernel-tools-libs-develUpgrade bpftoolUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade kernel-rtUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-64k-debug-modules-extraUpgrade kernel-64k-develUpgrade kernel-debug-develUpgrade libperfUpgrade kernel-develUpgrade kernel-rt-debug-develUpgrade kernel-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-rt-develUpgrade rtlaUpgrade kernel-cross-headersUpgrade kernel-coreUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-develUpgrade kernelUpgrade kernel-64kUpgrade kernel-64k-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-headersUpgrade kernel-modulesUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-uki-virtUpgrade kernel-64k-debug-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-tools-libsUpgrade perfUpgrade python3-perfUpgrade kernel-rt-coreUpgrade kernel-64k-modulesUpgrade kernel-rt-debugUpgrade kernel-zfcpdumpUpgrade kernel-modules-coreUpgrade kernel-debugUpgrade kernel-debug-core | Nov 4, 2024 | May 19, 2024 |
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | May 19, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Dec 5, 2024 | May 19, 2024 |
| Rocky_linux | — | Upgrade kernel-debug-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-modulesUpgrade perf-debuginfoUpgrade libperfUpgrade kernel-devel-matchedUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-develUpgrade kernel-rt-modules-coreUpgrade bpftool-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-develUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-modules-extraUpgrade kernel-headersUpgrade kernelUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debug-develUpgrade rtlaUpgrade libperf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-uki-virtUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libs-develUpgrade python3-perf-debuginfoUpgrade python3-perfUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-modules-coreUpgrade kernel-coreUpgrade kernel-rt-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debug-coreUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-modulesUpgrade perfUpgrade kernel-debugUpgrade bpftoolUpgrade kernel-rt-modulesUpgrade kernel-zfcpdumpUpgrade rvUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-toolsUpgrade kernel-rt-develUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-tools-libsUpgrade kernel-rt-debugUpgrade kernel-rtUpgrade kernel-develUpgrade kernel-rt-coreUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-modules-extra | Aug 22, 2024 | May 19, 2024 |
| Suse | — | Upgrade kernel-develUpgrade dtb-socionextUpgrade reiserfs-kmp-rtUpgrade kernel-default-baseUpgrade kernel-default-livepatch-develUpgrade kernel-default-optionalUpgrade kernel-debug-develUpgrade kernel-devel-rtUpgrade dtb-xilinxUpgrade dtb-marvellUpgrade kernel-64kbUpgrade ocfs2-kmp-64kbUpgrade dtb-allwinnerUpgrade dtb-amdUpgrade reiserfs-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade ocfs2-kmp-azureUpgrade dtb-freescaleUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-extraUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-livepatchUpgrade kernel-64kb-develUpgrade dtb-caviumUpgrade dtb-broadcomUpgrade gfs2-kmp-defaultUpgrade kernel-docsUpgrade kernel-debugUpgrade cluster-md-kmp-rtUpgrade kernel-azure-extraUpgrade dtb-alteraUpgrade ocfs2-kmp-defaultUpgrade dtb-amazonUpgrade dtb-mediatekUpgrade cluster-md-kmp-64kbUpgrade kernel-default-develUpgrade dlm-kmp-defaultUpgrade kernel-rt_debugUpgrade kernel-defaultUpgrade kernel-docs-htmlUpgrade dtb-hisiliconUpgrade kernel-rt-develUpgrade kernel-64kb-optionalUpgrade kernel-symsUpgrade kselftests-kmp-defaultUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-azureUpgrade kernel-zfcpdumpUpgrade kselftests-kmp-rtUpgrade dtb-renesasUpgrade dlm-kmp-rtUpgrade dtb-appleUpgrade kselftests-kmp-azureUpgrade kernel-source-vanillaUpgrade kernel-azure-develUpgrade dtb-qcomUpgrade kernel-devel-azureUpgrade dlm-kmp-64kbUpgrade kernel-obs-buildUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-rt_debug-develUpgrade kernel-macrosUpgrade dtb-apmUpgrade kernel-syms-rtUpgrade kernel-rtUpgrade kernel-azure-optionalUpgrade dtb-exynosUpgrade kernel-source-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-livepatch-develUpgrade kernel-syms-azureUpgrade kernel-rt-extraUpgrade kernel-rt-optionalUpgrade kernel-obs-qaUpgrade kernel-default-base-rebuildUpgrade dtb-nvidiaUpgrade kernel-azureUpgrade dtb-sprdUpgrade kernel-sourceUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmallUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-64kbUpgrade kernel-source-azureUpgrade gfs2-kmp-rtUpgrade dlm-kmp-azureUpgrade kernel-default-vdsoUpgrade dtb-lgUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade dtb-rockchipUpgrade dtb-armUpgrade dtb-amlogicUpgrade kernel-rt-livepatch-develUpgrade kernel-default-extra | Jun 24, 2024 | May 19, 2024 |
| Ubuntu | — | Upgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-gkeUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-azureUpgrade linux-image-kvmUpgrade linux-image-awsUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-intelUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-generic-64kUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-gcpUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-genericUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oracleUpgrade linux-image-generic-lpaeUpgrade linux-image-ibm-classicUpgrade linux-image-oem-24.04a | Jul 12, 2024 | May 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub