In the Linux kernel, the following vulnerability has been resolved:
net: hns3: do not allow call hns3_nic_net_open repeatedly
hns3_nic_net_open() is not allowed to called repeatly, but there is no checking for this. When doing device reset and setup tc concurrently, there is a small oppotunity to call hns3_nic_net_open repeatedly, and cause kernel bug by calling napi_enable twice.
The calltrace information is like below: [ 3078.222780] ------------[ cut here ]------------ [ 3078.230255] kernel BUG at net/core/dev.c:6991! [ 3078.236224] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 3078.243431] Modules linked in: hns3 hclgevf hclge hnae3 vfio_iommu_type1 vfio_pci vfio_virqfd vfio pv680_mii(O) [ 3078.258880] CPU: 0 PID: 295 Comm: kworker/u8:5 Tainted: G O 5.14.0-rc4+ #1 [ 3078.269102] Hardware name: , BIOS KpxxxFPGA 1P B600 V181 08/12/2021 [ 3078.276801] Workqueue: hclge hclge_service_task [hclge] [ 3078.288774] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--) [ 3078.296168] pc : napi_enable+0x80/0x84 tc qdisc sho[w 3d0e7v8 .e3t0h218 79] lr : hns3_nic_net_open+0x138/0x510 [hns3]
[ 3078.314771] sp : ffff8000108abb20 [ 3078.319099] x29: ffff8000108abb20 x28: 0000000000000000 x27: ffff0820a8490300 [ 3078.329121] x26: 0000000000000001 x25: ffff08209cfc6200 x24: 0000000000000000 [ 3078.339044] x23: ffff0820a8490300 x22: ffff08209cd76000 x21: ffff0820abfe3880 [ 3078.349018] x20: 0000000000000000 x19: ffff08209cd76900 x18: 0000000000000000 [ 3078.358620] x17: 0000000000000000 x16: ffffc816e1727a50 x15: 0000ffff8f4ff930 [ 3078.368895] x14: 0000000000000000 x13: 0000000000000000 x12: 0000259e9dbeb6b4 [ 3078.377987] x11: 0096a8f7e764eb40 x10: 634615ad28d3eab5 x9 : ffffc816ad8885b8 [ 3078.387091] x8 : ffff08209cfc6fb8 x7 : ffff0820ac0da058 x6 : ffff0820a8490344 [ 3078.396356] x5 : 0000000000000140 x4 : 0000000000000003 x3 : ffff08209cd76938 [ 3078.405365] x2 : 0000000000000000 x1 : 0000000000000010 x0 : ffff0820abfe38a0 [ 3078.414657] Call trace: [ 3078.418517] napi_enable+0x80/0x84 [ 3078.424626] hns3_reset_notify_up_enet+0x78/0xd0 [hns3] [ 3078.433469] hns3_reset_notify+0x64/0x80 [hns3] [ 3078.441430] hclge_notify_client+0x68/0xb0 [hclge] [ 3078.450511] hclge_reset_rebuild+0x524/0x884 [hclge] [ 3078.458879] hclge_reset_service_task+0x3c4/0x680 [hclge] [ 3078.467470] hclge_service_task+0xb0/0xb54 [hclge] [ 3078.475675] process_one_work+0x1dc/0x48c [ 3078.481888] worker_thread+0x15c/0x464 [ 3078.487104] kthread+0x160/0x170 [ 3078.492479] ret_from_fork+0x10/0x18 [ 3078.498785] Code: c8027c81 35ffffa2 d50323bf d65f03c0 (d4210000) [ 3078.506889] ---[ end trace 8ebe0340a1b0fb44 ]---
Once hns3_nic_net_open() is excute success, the flag HNS3_NIC_STATE_DOWN will be cleared. So add checking for this flag, directly return when HNS3_NIC_STATE_DOWN is no set.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rtlaUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-coreUpgrade perfUpgrade python3-perfUpgrade kernel-debug-modules-coreUpgrade rvUpgrade kernel-rt-develUpgrade kernel-64k-debug-coreUpgrade kernel-zfcpdumpUpgrade kernel-64k-modulesUpgrade kernel-64k-debug-develUpgrade kernel-toolsUpgrade kernel-rt-debugUpgrade kernel-cross-headersUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-coreUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-debug-develUpgrade bpftoolUpgrade kernel-develUpgrade kernel-rt-modulesUpgrade kernel-tools-libsUpgrade kernel-64k-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-coreUpgrade kernel-64kUpgrade kernel-debugUpgrade kernel-64k-develUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-develUpgrade kernel-rtUpgrade kernel-uki-virtUpgrade kernel-docUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-devel-matchedUpgrade kernel-debug-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-modulesUpgrade kernel-devel-matchedUpgrade kernel-64k-debug-modules-extraUpgrade kernelUpgrade kernel-headersUpgrade kernel-tools-libs-develUpgrade kernel-64k-debugUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-coreUpgrade libperf | Nov 4, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Nov 11, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-tools | Nov 11, 2024 | May 21, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 9, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Jun 27, 2024 | May 21, 2024 |
| Rocky_linux | — | Upgrade kernel-zfcpdump-modules-coreUpgrade kernelUpgrade kernel-zfcpdumpUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-modulesUpgrade libperf-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-debug-devel-matchedUpgrade kernel-toolsUpgrade kernel-rtUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-cross-headersUpgrade kernel-rt-debug-debuginfoUpgrade kernel-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-modulesUpgrade kernel-headersUpgrade rvUpgrade bpftool-debuginfoUpgrade kernel-devel-matchedUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-coreUpgrade libperfUpgrade kernel-rt-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade rtlaUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-rt-develUpgrade kernel-debugUpgrade bpftoolUpgrade kernel-debug-develUpgrade kernel-debug-uki-virtUpgrade kernel-rt-coreUpgrade perf-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-coreUpgrade kernel-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade perfUpgrade kernel-rt-debugUpgrade python3-perf-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-modules-extraUpgrade kernel-develUpgrade kernel-zfcpdump-develUpgrade python3-perfUpgrade kernel-debug-coreUpgrade kernel-uki-virt | Jul 16, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-azure-vdsoUpgrade ocfs2-kmp-rtUpgrade kernel-source-azureUpgrade dtb-qcomUpgrade reiserfs-kmp-64kbUpgrade kernel-default-manUpgrade kernel-azure-optionalUpgrade kernel-debug-vdsoUpgrade kernel-rtUpgrade reiserfs-kmp-azureUpgrade kernel-azureUpgrade kernel-devel-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-sourceUpgrade kernel-syms-rtUpgrade kernel-obs-qaUpgrade dtb-exynosUpgrade dtb-lgUpgrade dlm-kmp-64kbUpgrade dtb-alteraUpgrade kernel-rt_debug-develUpgrade kernel-macrosUpgrade kernel-debug-livepatch-develUpgrade dtb-armUpgrade kernel-rt-livepatch-develUpgrade dtb-amlogicUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmallUpgrade kernel-default-extraUpgrade dtb-apmUpgrade kernel-default-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade kernel-source-rtUpgrade kernel-zfcpdumpUpgrade kernel-default-base-rebuildUpgrade kernel-obs-buildUpgrade dtb-rockchipUpgrade dtb-nvidiaUpgrade kernel-azure-develUpgrade gfs2-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-syms-azureUpgrade kselftests-kmp-64kbUpgrade kernel-rt-optionalUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-azureUpgrade kernel-kvmsmall-develUpgrade kernel-rt-extraUpgrade kernel-rt-vdsoUpgrade kernel-azure-extraUpgrade gfs2-kmp-defaultUpgrade dtb-xilinxUpgrade gfs2-kmp-azureUpgrade kernel-rt-develUpgrade dtb-sprdUpgrade kernel-symsUpgrade dtb-freescaleUpgrade kernel-64kb-extraUpgrade kernel-rt_debugUpgrade kernel-debugUpgrade kernel-azure-baseUpgrade kernel-default-livepatch-develUpgrade dlm-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-rt_debug-livepatch-develUpgrade dlm-kmp-defaultUpgrade dtb-caviumUpgrade cluster-md-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-rt-livepatchUpgrade kernel-64kb-optionalUpgrade kernel-64kbUpgrade dtb-renesasUpgrade kernel-default-livepatchUpgrade dtb-socionextUpgrade reiserfs-kmp-rtUpgrade dtb-hisiliconUpgrade ocfs2-kmp-defaultUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-marvellUpgrade kernel-64kb-livepatch-develUpgrade dtb-broadcomUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-develUpgrade kernel-64kb-develUpgrade kernel-default-baseUpgrade dtb-amdUpgrade dtb-mediatekUpgrade gfs2-kmp-64kbUpgrade kernel-default-develUpgrade dlm-kmp-rtUpgrade kselftests-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-default-optionalUpgrade dtb-appleUpgrade kernel-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-docsUpgrade dtb-amazonUpgrade kernel-devel-rt | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-gcp-5.4Upgrade linux-gcp-fipsUpgrade linux-azure-5.4Upgrade linuxUpgrade linux-ibmUpgrade linux-azure-fipsUpgrade linux-hwe-5.4Upgrade linux-oracleUpgrade linux-gkeopUpgrade linux-aws-fipsUpgrade linux-fipsUpgrade linux-raspiUpgrade linux-oracle-5.4Upgrade linux-aws-5.4Upgrade linux-kvmUpgrade linux-bluefieldUpgrade linux-raspi-5.4Upgrade linux-gcpUpgrade linux-awsUpgrade linux-azure | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub