In the Linux kernel, the following vulnerability has been resolved:
ice: fix memory corruption bug with suspend and rebuild
The ice driver would previously panic after suspend. This is caused from the driver *only* calling the ice_vsi_free_q_vectors() function by itself, when it is suspending. Since commit b3e7b3a6ee92 ("ice: prevent NULL pointer deref during reload") the driver has zeroed out num_q_vectors, and only restored it in ice_vsi_cfg_def().
This further causes the ice_rebuild() function to allocate a zero length buffer, after which num_q_vectors is updated, and then the new value of num_q_vectors is used to index into the zero length buffer, which corrupts memory.
The fix entails making sure all the code referencing num_q_vectors only does so after it has been reset via ice_vsi_cfg_def().
I didn't perform a full bisect, but I was able to test against 6.1.77 kernel and that ice driver works fine for suspend/resume with no panic, so sometime since then, this problem was introduced.
Also clean up an un-needed init of a local variable in the function being modified.
PANIC from 6.8.0-rc1:
[1026674.915596] PM: suspend exit [1026675.664697] ice 0000:17:00.1: PTP reset successful [1026675.664707] ice 0000:17:00.1: 2755 msecs passed between update to cached PHC time [1026675.667660] ice 0000:b1:00.0: PTP reset successful [1026675.675944] ice 0000:b1:00.0: 2832 msecs passed between update to cached PHC time [1026677.137733] ixgbe 0000:31:00.0 ens787: NIC Link is Up 1 Gbps, Flow Control: None [1026677.190201] BUG: kernel NULL pointer dereference, address: 0000000000000010 [1026677.192753] ice 0000:17:00.0: PTP reset successful [1026677.192764] ice 0000:17:00.0: 4548 msecs passed between update to cached PHC time [1026677.197928] #PF: supervisor read access in kernel mode [1026677.197933] #PF: error_code(0x0000) - not-present page [1026677.197937] PGD 1557a7067 P4D 0 [1026677.212133] ice 0000:b1:00.1: PTP reset successful [1026677.212143] ice 0000:b1:00.1: 4344 msecs passed between update to cached PHC time [1026677.212575] [1026677.243142] Oops: 0000 [#1] PREEMPT SMP NOPTI [1026677.247918] CPU: 23 PID: 42790 Comm: kworker/23:0 Kdump: loaded Tainted: G W 6.8.0-rc1+ #1 [1026677.257989] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022 [1026677.269367] Workqueue: ice ice_service_task [ice] [1026677.274592] RIP: 0010:ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice] [1026677.281421] Code: 0f 84 3a ff ff ff 41 0f b7 74 ec 02 66 89 b0 22 02 00 00 81 e6 ff 1f 00 00 e8 ec fd ff ff e9 35 ff ff ff 48 8b 43 30 49 63 ed <41> 0f b7 34 24 41 83 c5 01 48 8b 3c e8 66 89 b7 aa 02 00 00 81 e6 [1026677.300877] RSP: 0018:ff3be62a6399bcc0 EFLAGS: 00010202 [1026677.306556] RAX: ff28691e28980828 RBX: ff28691e41099828 RCX: 0000000000188000 [1026677.314148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff28691e41099828 [1026677.321730] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [1026677.329311] R10: 0000000000000007 R11: ffffffffffffffc0 R12: 0000000000000010 [1026677.336896] R13: 0000000000000000 R14: 0000000000000000 R15: ff28691e0eaa81a0 [1026677.344472] FS: 0000000000000000(0000) GS:ff28693cbffc0000(0000) knlGS:0000000000000000 [1026677.353000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1026677.359195] CR2: 0000000000000010 CR3: 0000000128df4001 CR4: 0000000000771ef0 [1026677.366779] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1026677.374369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1026677.381952] PKRU: 55555554 [1026677.385116] Call Trace: [1026677.388023] <TASK> [1026677.390589] ? __die+0x20/0x70 [1026677.394105] ? page_fault_oops+0x82/0x160 [1026677.398576] ? do_user_addr_fault+0x65/0x6a0 [1026677.403307] ? exc_page_fault+0x6a/0x150 [1026677.407694] ? asm_exc_page_fault+0x22/0x30 [1026677.412349] ? ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice] [1026677.4186 ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-develUpgrade kernel-cross-headersUpgrade kernel-rt-develUpgrade kernel-rt-debugUpgrade kernel-debug-modules-coreUpgrade kernel-64k-modulesUpgrade kernel-headersUpgrade python3-perfUpgrade kernel-rt-debug-develUpgrade kernel-64k-modules-coreUpgrade kernel-modules-extraUpgrade kernel-64k-debug-develUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade rtlaUpgrade perfUpgrade kernel-64k-debug-coreUpgrade kernel-64kUpgrade kernel-rt-coreUpgrade kernel-tools-libsUpgrade kernel-debugUpgrade kernel-debug-coreUpgrade kernel-modules-coreUpgrade kernel-uki-virtUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-debug-modulesUpgrade kernelUpgrade kernel-zfcpdump-develUpgrade kernel-debug-uki-virtUpgrade libperfUpgrade kernel-coreUpgrade kernel-64k-develUpgrade kernel-zfcpdumpUpgrade kernel-modulesUpgrade kernel-debug-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-modulesUpgrade rvUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-coreUpgrade kernel-64k-modules-extraUpgrade kernel-64k-debug-modules-extraUpgrade kernel-toolsUpgrade kernel-docUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-modules-coreUpgrade bpftoolUpgrade kernel-rtUpgrade kernel-zfcpdump-modules | Nov 4, 2024 | May 19, 2024 |
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | May 19, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Dec 5, 2024 | May 19, 2024 |
| Rocky_linux | — | Upgrade kernel-tools-libs-develUpgrade kernel-debug-develUpgrade kernel-headersUpgrade kernel-rt-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade libperf-debuginfoUpgrade kernel-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernelUpgrade kernel-rt-debug-modules-extraUpgrade bpftool-debuginfoUpgrade kernel-cross-headersUpgrade kernel-debug-modulesUpgrade rtlaUpgrade kernel-debuginfoUpgrade kernel-devel-matchedUpgrade libperfUpgrade kernel-zfcpdump-develUpgrade perf-debuginfoUpgrade kernel-uki-virtUpgrade kernel-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-kvmUpgrade rvUpgrade kernel-rt-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-toolsUpgrade kernel-rt-develUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-modulesUpgrade perfUpgrade kernel-zfcpdumpUpgrade kernel-rt-modulesUpgrade bpftoolUpgrade kernel-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-debugUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-tools-libsUpgrade kernel-tools-debuginfoUpgrade kernel-rt-coreUpgrade kernel-debug-modules-coreUpgrade kernel-rtUpgrade kernel-rt-debugUpgrade kernel-develUpgrade kernel-modules-extraUpgrade kernel-debug-coreUpgrade python3-perfUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-uki-virt | Aug 22, 2024 | May 19, 2024 |
| Suse | — | Upgrade kernel-64kb-livepatch-develUpgrade kernel-64kbUpgrade kernel-64kb-extraUpgrade kselftests-kmp-rtUpgrade dtb-caviumUpgrade kernel-defaultUpgrade ocfs2-kmp-rtUpgrade dtb-renesasUpgrade dtb-amdUpgrade dtb-xilinxUpgrade kselftests-kmp-defaultUpgrade kernel-zfcpdumpUpgrade kernel-default-livepatchUpgrade kernel-kvmsmall-livepatch-develUpgrade gfs2-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade dtb-allwinnerUpgrade dtb-broadcomUpgrade kernel-azure-extraUpgrade kernel-rt_debugUpgrade cluster-md-kmp-64kbUpgrade dtb-amazonUpgrade dtb-mediatekUpgrade kernel-default-develUpgrade cluster-md-kmp-rtUpgrade dtb-freescaleUpgrade kernel-develUpgrade reiserfs-kmp-rtUpgrade kernel-devel-rtUpgrade dtb-socionextUpgrade kernel-debugUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-default-optionalUpgrade kernel-debug-develUpgrade dtb-marvellUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-default-baseUpgrade kernel-64kb-optionalUpgrade dtb-appleUpgrade dtb-hisiliconUpgrade dlm-kmp-defaultUpgrade kernel-symsUpgrade kernel-rt_debug-livepatch-develUpgrade cluster-md-kmp-azureUpgrade dlm-kmp-rtUpgrade gfs2-kmp-azureUpgrade kernel-docsUpgrade kernel-rt-develUpgrade kernel-docs-htmlUpgrade dtb-alteraUpgrade kernel-debug-livepatch-develUpgrade dlm-kmp-64kbUpgrade kernel-azure-develUpgrade kernel-rt-livepatch-develUpgrade dtb-exynosUpgrade kernel-default-extraUpgrade kernel-obs-buildUpgrade kernel-syms-rtUpgrade kernel-rt_debug-develUpgrade kernel-macrosUpgrade kselftests-kmp-azureUpgrade kernel-azure-vdsoUpgrade dtb-apmUpgrade kernel-rtUpgrade reiserfs-kmp-azureUpgrade kernel-sourceUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmallUpgrade kernel-debug-vdsoUpgrade kernel-azureUpgrade dtb-sprdUpgrade dtb-nvidiaUpgrade kernel-azure-livepatch-develUpgrade dlm-kmp-azureUpgrade kernel-default-vdsoUpgrade dtb-lgUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-obs-qaUpgrade kernel-syms-azureUpgrade kernel-rt-optionalUpgrade kernel-rt-extraUpgrade kernel-default-base-rebuildUpgrade dtb-qcomUpgrade kernel-devel-azureUpgrade dtb-rockchipUpgrade dtb-armUpgrade dtb-amlogicUpgrade gfs2-kmp-rtUpgrade kernel-source-rtUpgrade kernel-azure-optionalUpgrade kernel-rt_debug-vdsoUpgrade kernel-source-vanilla | Jun 24, 2024 | May 19, 2024 |
| Ubuntu | — | Upgrade linux-image-oracle-64kUpgrade linux-image-intelUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-oracleUpgrade linux-image-genericUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-generic-lpaeUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-gcpUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-ibmUpgrade linux-image-nvidiaUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-generic-64kUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-nvidia-64kUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-azureUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-raspiUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1010-azureUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-awsUpgrade linux-image-6.8.0-1008-oem | Jul 12, 2024 | May 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub