In the Linux kernel, the following vulnerability has been resolved:
net: hns3: do not allow call hns3_nic_net_open repeatedly
hns3_nic_net_open() is not allowed to called repeatly, but there is no checking for this. When doing device reset and setup tc concurrently, there is a small oppotunity to call hns3_nic_net_open repeatedly, and cause kernel bug by calling napi_enable twice.
The calltrace information is like below: [ 3078.222780] ------------[ cut here ]------------ [ 3078.230255] kernel BUG at net/core/dev.c:6991! [ 3078.236224] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 3078.243431] Modules linked in: hns3 hclgevf hclge hnae3 vfio_iommu_type1 vfio_pci vfio_virqfd vfio pv680_mii(O) [ 3078.258880] CPU: 0 PID: 295 Comm: kworker/u8:5 Tainted: G O 5.14.0-rc4+ #1 [ 3078.269102] Hardware name: , BIOS KpxxxFPGA 1P B600 V181 08/12/2021 [ 3078.276801] Workqueue: hclge hclge_service_task [hclge] [ 3078.288774] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--) [ 3078.296168] pc : napi_enable+0x80/0x84 tc qdisc sho[w 3d0e7v8 .e3t0h218 79] lr : hns3_nic_net_open+0x138/0x510 [hns3]
[ 3078.314771] sp : ffff8000108abb20 [ 3078.319099] x29: ffff8000108abb20 x28: 0000000000000000 x27: ffff0820a8490300 [ 3078.329121] x26: 0000000000000001 x25: ffff08209cfc6200 x24: 0000000000000000 [ 3078.339044] x23: ffff0820a8490300 x22: ffff08209cd76000 x21: ffff0820abfe3880 [ 3078.349018] x20: 0000000000000000 x19: ffff08209cd76900 x18: 0000000000000000 [ 3078.358620] x17: 0000000000000000 x16: ffffc816e1727a50 x15: 0000ffff8f4ff930 [ 3078.368895] x14: 0000000000000000 x13: 0000000000000000 x12: 0000259e9dbeb6b4 [ 3078.377987] x11: 0096a8f7e764eb40 x10: 634615ad28d3eab5 x9 : ffffc816ad8885b8 [ 3078.387091] x8 : ffff08209cfc6fb8 x7 : ffff0820ac0da058 x6 : ffff0820a8490344 [ 3078.396356] x5 : 0000000000000140 x4 : 0000000000000003 x3 : ffff08209cd76938 [ 3078.405365] x2 : 0000000000000000 x1 : 0000000000000010 x0 : ffff0820abfe38a0 [ 3078.414657] Call trace: [ 3078.418517] napi_enable+0x80/0x84 [ 3078.424626] hns3_reset_notify_up_enet+0x78/0xd0 [hns3] [ 3078.433469] hns3_reset_notify+0x64/0x80 [hns3] [ 3078.441430] hclge_notify_client+0x68/0xb0 [hclge] [ 3078.450511] hclge_reset_rebuild+0x524/0x884 [hclge] [ 3078.458879] hclge_reset_service_task+0x3c4/0x680 [hclge] [ 3078.467470] hclge_service_task+0xb0/0xb54 [hclge] [ 3078.475675] process_one_work+0x1dc/0x48c [ 3078.481888] worker_thread+0x15c/0x464 [ 3078.487104] kthread+0x160/0x170 [ 3078.492479] ret_from_fork+0x10/0x18 [ 3078.498785] Code: c8027c81 35ffffa2 d50323bf d65f03c0 (d4210000) [ 3078.506889] ---[ end trace 8ebe0340a1b0fb44 ]---
Once hns3_nic_net_open() is excute success, the flag HNS3_NIC_STATE_DOWN will be cleared. So add checking for this flag, directly return when HNS3_NIC_STATE_DOWN is no set.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-uki-virtUpgrade kernel-64k-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-headersUpgrade kernel-zfcpdump-develUpgrade kernel-64k-debugUpgrade kernel-rtUpgrade kernel-rt-debug-develUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernelUpgrade kernel-docUpgrade kernel-64k-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-devel-matchedUpgrade kernel-devel-matchedUpgrade kernel-abi-stablelistsUpgrade libperfUpgrade kernel-rt-debug-modules-coreUpgrade kernel-modules-extraUpgrade kernel-coreUpgrade kernel-64k-modules-coreUpgrade kernel-tools-libsUpgrade kernel-debug-coreUpgrade rtlaUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-64k-debug-modulesUpgrade kernel-zfcpdumpUpgrade rvUpgrade kernel-rt-develUpgrade kernel-debug-modules-coreUpgrade kernel-develUpgrade perfUpgrade kernel-debug-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-64k-debug-coreUpgrade kernel-rt-modules-extraUpgrade bpftoolUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-modules-extraUpgrade kernel-64kUpgrade kernel-debugUpgrade kernel-debug-develUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-coreUpgrade kernel-rt-modulesUpgrade kernel-64k-modulesUpgrade kernel-64k-develUpgrade kernel-rt-debugUpgrade kernel-64k-debug-develUpgrade kernel-toolsUpgrade kernel-cross-headersUpgrade python3-perf | Nov 4, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernelUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Nov 11, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libs | Nov 11, 2024 | May 21, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 9, 2024 | May 21, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jun 27, 2024 | May 21, 2024 |
| Rocky_linux | — | Upgrade kernel-uki-virtUpgrade kernel-tools-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-develUpgrade kernel-rt-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-debuginfoUpgrade rtlaUpgrade kernel-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-coreUpgrade bpftoolUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-develUpgrade kernel-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-rt-coreUpgrade python3-perfUpgrade kernel-debugUpgrade perf-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debugUpgrade kernel-develUpgrade perfUpgrade kernel-debug-devel-matchedUpgrade libperf-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-toolsUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-rt-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modulesUpgrade rvUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-cross-headersUpgrade kernel-rtUpgrade kernel-modules-coreUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-modules-coreUpgrade libperfUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-modulesUpgrade kernel-devel-matchedUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdumpUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-tools-libsUpgrade kernel-modulesUpgrade kernel-rt-modules | Jul 16, 2024 | May 21, 2024 |
| Suse | — | Upgrade dtb-socionextUpgrade ocfs2-kmp-64kbUpgrade kernel-develUpgrade kernel-64kb-livepatch-develUpgrade dtb-mediatekUpgrade kernel-64kb-develUpgrade kernel-azure-extraUpgrade kernel-default-baseUpgrade dtb-marvellUpgrade reiserfs-kmp-rtUpgrade dtb-sprdUpgrade dtb-broadcomUpgrade dtb-amdUpgrade kernel-default-develUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-hisiliconUpgrade kernel-rt-develUpgrade kernel-devel-rtUpgrade dtb-appleUpgrade reiserfs-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade kernel-default-optionalUpgrade cluster-md-kmp-rtUpgrade dlm-kmp-rtUpgrade kernel-docsUpgrade kernel-docs-htmlUpgrade ocfs2-kmp-azureUpgrade dtb-amazonUpgrade dtb-allwinnerUpgrade kernel-azure-baseUpgrade dtb-caviumUpgrade kernel-default-livepatchUpgrade gfs2-kmp-64kbUpgrade kernel-64kbUpgrade kselftests-kmp-rtUpgrade kernel-defaultUpgrade kernel-64kb-extraUpgrade dtb-renesasUpgrade kernel-64kb-optionalUpgrade kernel-symsUpgrade kernel-debug-develUpgrade dlm-kmp-azureUpgrade kernel-debugUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-livepatchUpgrade dlm-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade dtb-xilinxUpgrade kselftests-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debugUpgrade gfs2-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-freescaleUpgrade kernel-azureUpgrade kernel-source-rtUpgrade dtb-lgUpgrade kernel-sourceUpgrade dlm-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kernel-azure-optionalUpgrade dtb-apmUpgrade kernel-kvmsmallUpgrade kernel-obs-buildUpgrade dtb-nvidiaUpgrade reiserfs-kmp-64kbUpgrade kernel-default-manUpgrade kernel-azure-vdsoUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-extraUpgrade kernel-azure-livepatch-develUpgrade kernel-default-vdsoUpgrade kernel-zfcpdumpUpgrade dtb-rockchipUpgrade kernel-obs-qaUpgrade kernel-syms-rtUpgrade kernel-devel-azureUpgrade kernel-default-base-rebuildUpgrade kernel-azure-develUpgrade kernel-debug-livepatch-develUpgrade gfs2-kmp-rtUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-rt_debug-develUpgrade dtb-qcomUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-rt-extraUpgrade kselftests-kmp-64kbUpgrade kernel-macrosUpgrade dtb-amlogicUpgrade dtb-exynosUpgrade dtb-armUpgrade ocfs2-kmp-rtUpgrade kernel-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-optionalUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-source-azureUpgrade kernel-debug-vdsoUpgrade dtb-altera | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-azure-fipsUpgrade linux-gcp-5.4Upgrade linux-azure-5.4Upgrade linux-ibmUpgrade linux-gkeopUpgrade linux-oracleUpgrade linux-hwe-5.4Upgrade linux-gcp-fipsUpgrade linuxUpgrade linux-aws-fipsUpgrade linux-raspi-5.4Upgrade linux-kvmUpgrade linux-aws-5.4Upgrade linux-bluefieldUpgrade linux-oracle-5.4Upgrade linux-raspiUpgrade linux-awsUpgrade linux-fipsUpgrade linux-azureUpgrade linux-gcp | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub