In the Linux kernel, the following vulnerability has been resolved:
ice: fix memory corruption bug with suspend and rebuild
The ice driver would previously panic after suspend. This is caused from the driver *only* calling the ice_vsi_free_q_vectors() function by itself, when it is suspending. Since commit b3e7b3a6ee92 ("ice: prevent NULL pointer deref during reload") the driver has zeroed out num_q_vectors, and only restored it in ice_vsi_cfg_def().
This further causes the ice_rebuild() function to allocate a zero length buffer, after which num_q_vectors is updated, and then the new value of num_q_vectors is used to index into the zero length buffer, which corrupts memory.
The fix entails making sure all the code referencing num_q_vectors only does so after it has been reset via ice_vsi_cfg_def().
I didn't perform a full bisect, but I was able to test against 6.1.77 kernel and that ice driver works fine for suspend/resume with no panic, so sometime since then, this problem was introduced.
Also clean up an un-needed init of a local variable in the function being modified.
PANIC from 6.8.0-rc1:
[1026674.915596] PM: suspend exit [1026675.664697] ice 0000:17:00.1: PTP reset successful [1026675.664707] ice 0000:17:00.1: 2755 msecs passed between update to cached PHC time [1026675.667660] ice 0000:b1:00.0: PTP reset successful [1026675.675944] ice 0000:b1:00.0: 2832 msecs passed between update to cached PHC time [1026677.137733] ixgbe 0000:31:00.0 ens787: NIC Link is Up 1 Gbps, Flow Control: None [1026677.190201] BUG: kernel NULL pointer dereference, address: 0000000000000010 [1026677.192753] ice 0000:17:00.0: PTP reset successful [1026677.192764] ice 0000:17:00.0: 4548 msecs passed between update to cached PHC time [1026677.197928] #PF: supervisor read access in kernel mode [1026677.197933] #PF: error_code(0x0000) - not-present page [1026677.197937] PGD 1557a7067 P4D 0 [1026677.212133] ice 0000:b1:00.1: PTP reset successful [1026677.212143] ice 0000:b1:00.1: 4344 msecs passed between update to cached PHC time [1026677.212575] [1026677.243142] Oops: 0000 [#1] PREEMPT SMP NOPTI [1026677.247918] CPU: 23 PID: 42790 Comm: kworker/23:0 Kdump: loaded Tainted: G W 6.8.0-rc1+ #1 [1026677.257989] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022 [1026677.269367] Workqueue: ice ice_service_task [ice] [1026677.274592] RIP: 0010:ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice] [1026677.281421] Code: 0f 84 3a ff ff ff 41 0f b7 74 ec 02 66 89 b0 22 02 00 00 81 e6 ff 1f 00 00 e8 ec fd ff ff e9 35 ff ff ff 48 8b 43 30 49 63 ed <41> 0f b7 34 24 41 83 c5 01 48 8b 3c e8 66 89 b7 aa 02 00 00 81 e6 [1026677.300877] RSP: 0018:ff3be62a6399bcc0 EFLAGS: 00010202 [1026677.306556] RAX: ff28691e28980828 RBX: ff28691e41099828 RCX: 0000000000188000 [1026677.314148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff28691e41099828 [1026677.321730] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [1026677.329311] R10: 0000000000000007 R11: ffffffffffffffc0 R12: 0000000000000010 [1026677.336896] R13: 0000000000000000 R14: 0000000000000000 R15: ff28691e0eaa81a0 [1026677.344472] FS: 0000000000000000(0000) GS:ff28693cbffc0000(0000) knlGS:0000000000000000 [1026677.353000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1026677.359195] CR2: 0000000000000010 CR3: 0000000128df4001 CR4: 0000000000771ef0 [1026677.366779] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1026677.374369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1026677.381952] PKRU: 55555554 [1026677.385116] Call Trace: [1026677.388023] <TASK> [1026677.390589] ? __die+0x20/0x70 [1026677.394105] ? page_fault_oops+0x82/0x160 [1026677.398576] ? do_user_addr_fault+0x65/0x6a0 [1026677.403307] ? exc_page_fault+0x6a/0x150 [1026677.407694] ? asm_exc_page_fault+0x22/0x30 [1026677.412349] ? ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice] [1026677.4186 ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-modulesUpgrade kernel-rt-debugUpgrade python3-perfUpgrade kernel-rt-coreUpgrade perfUpgrade kernel-headersUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-coreUpgrade libperfUpgrade kernel-64k-debug-coreUpgrade kernel-rt-develUpgrade kernel-debug-develUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-modulesUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-64kUpgrade kernel-develUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-develUpgrade kernel-64k-develUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-debug-develUpgrade kernel-uki-virtUpgrade kernel-tools-libsUpgrade kernel-cross-headersUpgrade kernel-debug-coreUpgrade kernel-debugUpgrade rtlaUpgrade kernel-modules-extraUpgrade kernel-64k-modules-coreUpgrade kernelUpgrade kernel-docUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-modulesUpgrade kernel-64k-modules-extraUpgrade kernel-devel-matchedUpgrade kernel-64k-devel-matchedUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-64k-debugUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rtUpgrade kernel-debug-modulesUpgrade rvUpgrade kernel-toolsUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade bpftool | Nov 4, 2024 | May 19, 2024 |
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | May 19, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Dec 5, 2024 | May 19, 2024 |
| Rocky_linux | — | Upgrade kernel-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-modules-extraUpgrade libperf-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-uki-virtUpgrade kernelUpgrade kernel-rt-debug-develUpgrade libperfUpgrade kernel-cross-headersUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-develUpgrade rtlaUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-modules-coreUpgrade kernel-debug-develUpgrade kernel-headersUpgrade kernel-zfcpdump-modules-coreUpgrade perf-debuginfoUpgrade kernel-devel-matchedUpgrade bpftool-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdumpUpgrade rvUpgrade kernel-debug-uki-virtUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-toolsUpgrade kernel-rt-debugUpgrade kernel-rtUpgrade kernel-develUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-tools-libsUpgrade kernel-tools-debuginfoUpgrade kernel-rt-modules-extraUpgrade perfUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-coreUpgrade python3-perfUpgrade kernel-modules-extraUpgrade kernel-debug-coreUpgrade kernel-debugUpgrade bpftoolUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-coreUpgrade kernel-rt-devel | Aug 22, 2024 | May 19, 2024 |
| Suse | — | Upgrade kernel-source-vanillaUpgrade dtb-exynosUpgrade kernel-default-extraUpgrade kernel-source-rtUpgrade kernel-obs-buildUpgrade kernel-rt_debug-vdsoUpgrade dlm-kmp-64kbUpgrade kernel-rt-optionalUpgrade kernel-default-base-rebuildUpgrade kernel-syms-azureUpgrade kernel-obs-qaUpgrade kernel-source-azureUpgrade kselftests-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade kernel-rt-extraUpgrade kernel-kvmsmall-develUpgrade kernel-rt-vdsoUpgrade kernel-sourceUpgrade kernel-rtUpgrade dlm-kmp-azureUpgrade gfs2-kmp-rtUpgrade kernel-azure-livepatch-develUpgrade dtb-nvidiaUpgrade reiserfs-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade dtb-rockchipUpgrade dtb-sprdUpgrade dtb-amlogicUpgrade dtb-qcomUpgrade dtb-armUpgrade dtb-lgUpgrade kernel-devel-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-default-vdsoUpgrade kernel-azureUpgrade kselftests-kmp-azureUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-develUpgrade kernel-rt_debug-develUpgrade kernel-macrosUpgrade kernel-azure-vdsoUpgrade dtb-apmUpgrade kernel-syms-rtUpgrade kernel-azure-optionalUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-vdsoUpgrade kernel-kvmsmallUpgrade cluster-md-kmp-rtUpgrade kernel-default-develUpgrade gfs2-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade kernel-64kb-extraUpgrade dtb-renesasUpgrade dtb-alteraUpgrade kernel-zfcpdumpUpgrade dtb-freescaleUpgrade reiserfs-kmp-rtUpgrade kernel-default-baseUpgrade kernel-64kb-develUpgrade dtb-socionextUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-debugUpgrade dtb-broadcomUpgrade kernel-rt_debugUpgrade dtb-mediatekUpgrade dtb-amazonUpgrade cluster-md-kmp-64kbUpgrade dtb-xilinxUpgrade dtb-amdUpgrade dtb-allwinnerUpgrade reiserfs-kmp-defaultUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-livepatchUpgrade kselftests-kmp-defaultUpgrade kernel-symsUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-docsUpgrade dtb-caviumUpgrade dtb-hisiliconUpgrade kernel-docs-htmlUpgrade dtb-appleUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade kernel-rt-develUpgrade gfs2-kmp-azureUpgrade kernel-64kb-optionalUpgrade dlm-kmp-rtUpgrade kernel-debug-develUpgrade kernel-64kbUpgrade kernel-devel-rtUpgrade kernel-develUpgrade kernel-default-optionalUpgrade kernel-default-livepatch-develUpgrade dtb-marvellUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-extraUpgrade kselftests-kmp-rtUpgrade kernel-default | Jun 24, 2024 | May 19, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-oem-24.04Upgrade linux-image-raspiUpgrade linux-image-kvmUpgrade linux-image-azureUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-nvidia-64kUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-awsUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-lowlatencyUpgrade linux-image-intelUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-gcpUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-ibmUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-genericUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-oracle-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-ibm-classicUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-generic-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1010-azure-fde | Jul 12, 2024 | May 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub