CVE-2024-26881 (GCVE-0-2024-26881)

Vulnerability from cvelistv5 – Published: 2024-04-17 10:27 – Updated: 2025-05-04 08:58
VLAI?
Title
net: hns3: fix kernel crash when 1588 is received on HIP08 devices
Summary
In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when 1588 is received on HIP08 devices The HIP08 devices does not register the ptp devices, so the hdev->ptp is NULL, but the hardware can receive 1588 messages, and set the HNS3_RXD_TS_VLD_B bit, so, if match this case, the access of hdev->ptp->flags will cause a kernel crash: [ 5888.946472] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 [ 5888.946475] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 ... [ 5889.266118] pc : hclge_ptp_get_rx_hwts+0x40/0x170 [hclge] [ 5889.272612] lr : hclge_ptp_get_rx_hwts+0x34/0x170 [hclge] [ 5889.279101] sp : ffff800012c3bc50 [ 5889.283516] x29: ffff800012c3bc50 x28: ffff2040002be040 [ 5889.289927] x27: ffff800009116484 x26: 0000000080007500 [ 5889.296333] x25: 0000000000000000 x24: ffff204001c6f000 [ 5889.302738] x23: ffff204144f53c00 x22: 0000000000000000 [ 5889.309134] x21: 0000000000000000 x20: ffff204004220080 [ 5889.315520] x19: ffff204144f53c00 x18: 0000000000000000 [ 5889.321897] x17: 0000000000000000 x16: 0000000000000000 [ 5889.328263] x15: 0000004000140ec8 x14: 0000000000000000 [ 5889.334617] x13: 0000000000000000 x12: 00000000010011df [ 5889.340965] x11: bbfeff4d22000000 x10: 0000000000000000 [ 5889.347303] x9 : ffff800009402124 x8 : 0200f78811dfbb4d [ 5889.353637] x7 : 2200000000191b01 x6 : ffff208002a7d480 [ 5889.359959] x5 : 0000000000000000 x4 : 0000000000000000 [ 5889.366271] x3 : 0000000000000000 x2 : 0000000000000000 [ 5889.372567] x1 : 0000000000000000 x0 : ffff20400095c080 [ 5889.378857] Call trace: [ 5889.382285] hclge_ptp_get_rx_hwts+0x40/0x170 [hclge] [ 5889.388304] hns3_handle_bdinfo+0x324/0x410 [hns3] [ 5889.394055] hns3_handle_rx_bd+0x60/0x150 [hns3] [ 5889.399624] hns3_clean_rx_ring+0x84/0x170 [hns3] [ 5889.405270] hns3_nic_common_poll+0xa8/0x220 [hns3] [ 5889.411084] napi_poll+0xcc/0x264 [ 5889.415329] net_rx_action+0xd4/0x21c [ 5889.419911] __do_softirq+0x130/0x358 [ 5889.424484] irq_exit+0x134/0x154 [ 5889.428700] __handle_domain_irq+0x88/0xf0 [ 5889.433684] gic_handle_irq+0x78/0x2c0 [ 5889.438319] el1_irq+0xb8/0x140 [ 5889.442354] arch_cpu_idle+0x18/0x40 [ 5889.446816] default_idle_call+0x5c/0x1c0 [ 5889.451714] cpuidle_idle_call+0x174/0x1b0 [ 5889.456692] do_idle+0xc8/0x160 [ 5889.460717] cpu_startup_entry+0x30/0xfc [ 5889.465523] secondary_start_kernel+0x158/0x1ec [ 5889.470936] Code: 97ffab78 f9411c14 91408294 f9457284 (f9400c80) [ 5889.477950] SMP: stopping secondary CPUs [ 5890.514626] SMP: failed to stop secondary CPUs 0-69,71-95 [ 5890.522951] Starting crashdump kernel...
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 0bf5eb788512187b744ef7f79de835e6cbe85b9c , < 23ec1cec24293f9799c725941677d4e167997265 (git)
Affected: 0bf5eb788512187b744ef7f79de835e6cbe85b9c , < b3cf70472a600bcb2efe24906bc9bc6014d4c6f6 (git)
Affected: 0bf5eb788512187b744ef7f79de835e6cbe85b9c , < f0b5225a7dfc1bf53c98215db8c2f0b4efd3f108 (git)
Affected: 0bf5eb788512187b744ef7f79de835e6cbe85b9c , < b2bb19114c079dcfec1ea46e761f510e30505e70 (git)
Affected: 0bf5eb788512187b744ef7f79de835e6cbe85b9c , < 11b998360d96f6c76f04a95f54b49f24d3c858e4 (git)
Affected: 0bf5eb788512187b744ef7f79de835e6cbe85b9c , < 0fbcf2366ba9888cf02eda23e35fde7f7fcc07c3 (git)
Create a notification for this product.
    Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.153 , ≤ 5.15.* (semver)
Unaffected: 6.1.83 , ≤ 6.1.* (semver)
Unaffected: 6.6.23 , ≤ 6.6.* (semver)
Unaffected: 6.7.11 , ≤ 6.7.* (semver)
Unaffected: 6.8.2 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26881",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T16:27:31.447610Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-12T16:27:38.120Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:04.243Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/23ec1cec24293f9799c725941677d4e167997265"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b3cf70472a600bcb2efe24906bc9bc6014d4c6f6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f0b5225a7dfc1bf53c98215db8c2f0b4efd3f108"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b2bb19114c079dcfec1ea46e761f510e30505e70"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/11b998360d96f6c76f04a95f54b49f24d3c858e4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0fbcf2366ba9888cf02eda23e35fde7f7fcc07c3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "23ec1cec24293f9799c725941677d4e167997265",
              "status": "affected",
              "version": "0bf5eb788512187b744ef7f79de835e6cbe85b9c",
              "versionType": "git"
            },
            {
              "lessThan": "b3cf70472a600bcb2efe24906bc9bc6014d4c6f6",
              "status": "affected",
              "version": "0bf5eb788512187b744ef7f79de835e6cbe85b9c",
              "versionType": "git"
            },
            {
              "lessThan": "f0b5225a7dfc1bf53c98215db8c2f0b4efd3f108",
              "status": "affected",
              "version": "0bf5eb788512187b744ef7f79de835e6cbe85b9c",
              "versionType": "git"
            },
            {
              "lessThan": "b2bb19114c079dcfec1ea46e761f510e30505e70",
              "status": "affected",
              "version": "0bf5eb788512187b744ef7f79de835e6cbe85b9c",
              "versionType": "git"
            },
            {
              "lessThan": "11b998360d96f6c76f04a95f54b49f24d3c858e4",
              "status": "affected",
              "version": "0bf5eb788512187b744ef7f79de835e6cbe85b9c",
              "versionType": "git"
            },
            {
              "lessThan": "0fbcf2366ba9888cf02eda23e35fde7f7fcc07c3",
              "status": "affected",
              "version": "0bf5eb788512187b744ef7f79de835e6cbe85b9c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.153",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.83",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fix kernel crash when 1588 is received on HIP08 devices\n\nThe HIP08 devices does not register the ptp devices, so the\nhdev-\u003eptp is NULL, but the hardware can receive 1588 messages,\nand set the HNS3_RXD_TS_VLD_B bit, so, if match this case, the\naccess of hdev-\u003eptp-\u003eflags will cause a kernel crash:\n\n[ 5888.946472] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018\n[ 5888.946475] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018\n...\n[ 5889.266118] pc : hclge_ptp_get_rx_hwts+0x40/0x170 [hclge]\n[ 5889.272612] lr : hclge_ptp_get_rx_hwts+0x34/0x170 [hclge]\n[ 5889.279101] sp : ffff800012c3bc50\n[ 5889.283516] x29: ffff800012c3bc50 x28: ffff2040002be040\n[ 5889.289927] x27: ffff800009116484 x26: 0000000080007500\n[ 5889.296333] x25: 0000000000000000 x24: ffff204001c6f000\n[ 5889.302738] x23: ffff204144f53c00 x22: 0000000000000000\n[ 5889.309134] x21: 0000000000000000 x20: ffff204004220080\n[ 5889.315520] x19: ffff204144f53c00 x18: 0000000000000000\n[ 5889.321897] x17: 0000000000000000 x16: 0000000000000000\n[ 5889.328263] x15: 0000004000140ec8 x14: 0000000000000000\n[ 5889.334617] x13: 0000000000000000 x12: 00000000010011df\n[ 5889.340965] x11: bbfeff4d22000000 x10: 0000000000000000\n[ 5889.347303] x9 : ffff800009402124 x8 : 0200f78811dfbb4d\n[ 5889.353637] x7 : 2200000000191b01 x6 : ffff208002a7d480\n[ 5889.359959] x5 : 0000000000000000 x4 : 0000000000000000\n[ 5889.366271] x3 : 0000000000000000 x2 : 0000000000000000\n[ 5889.372567] x1 : 0000000000000000 x0 : ffff20400095c080\n[ 5889.378857] Call trace:\n[ 5889.382285] hclge_ptp_get_rx_hwts+0x40/0x170 [hclge]\n[ 5889.388304] hns3_handle_bdinfo+0x324/0x410 [hns3]\n[ 5889.394055] hns3_handle_rx_bd+0x60/0x150 [hns3]\n[ 5889.399624] hns3_clean_rx_ring+0x84/0x170 [hns3]\n[ 5889.405270] hns3_nic_common_poll+0xa8/0x220 [hns3]\n[ 5889.411084] napi_poll+0xcc/0x264\n[ 5889.415329] net_rx_action+0xd4/0x21c\n[ 5889.419911] __do_softirq+0x130/0x358\n[ 5889.424484] irq_exit+0x134/0x154\n[ 5889.428700] __handle_domain_irq+0x88/0xf0\n[ 5889.433684] gic_handle_irq+0x78/0x2c0\n[ 5889.438319] el1_irq+0xb8/0x140\n[ 5889.442354] arch_cpu_idle+0x18/0x40\n[ 5889.446816] default_idle_call+0x5c/0x1c0\n[ 5889.451714] cpuidle_idle_call+0x174/0x1b0\n[ 5889.456692] do_idle+0xc8/0x160\n[ 5889.460717] cpu_startup_entry+0x30/0xfc\n[ 5889.465523] secondary_start_kernel+0x158/0x1ec\n[ 5889.470936] Code: 97ffab78 f9411c14 91408294 f9457284 (f9400c80)\n[ 5889.477950] SMP: stopping secondary CPUs\n[ 5890.514626] SMP: failed to stop secondary CPUs 0-69,71-95\n[ 5890.522951] Starting crashdump kernel..."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:58:45.795Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/23ec1cec24293f9799c725941677d4e167997265"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3cf70472a600bcb2efe24906bc9bc6014d4c6f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0b5225a7dfc1bf53c98215db8c2f0b4efd3f108"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2bb19114c079dcfec1ea46e761f510e30505e70"
        },
        {
          "url": "https://git.kernel.org/stable/c/11b998360d96f6c76f04a95f54b49f24d3c858e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fbcf2366ba9888cf02eda23e35fde7f7fcc07c3"
        }
      ],
      "title": "net: hns3: fix kernel crash when 1588 is received on HIP08 devices",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26881",
    "datePublished": "2024-04-17T10:27:37.744Z",
    "dateReserved": "2024-02-19T14:20:24.185Z",
    "dateUpdated": "2025-05-04T08:58:45.795Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/23ec1cec24293f9799c725941677d4e167997265\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b3cf70472a600bcb2efe24906bc9bc6014d4c6f6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f0b5225a7dfc1bf53c98215db8c2f0b4efd3f108\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b2bb19114c079dcfec1ea46e761f510e30505e70\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/11b998360d96f6c76f04a95f54b49f24d3c858e4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0fbcf2366ba9888cf02eda23e35fde7f7fcc07c3\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:21:04.243Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26881\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-12T16:27:31.447610Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-12T16:27:35.585Z\"}}], \"cna\": {\"title\": \"net: hns3: fix kernel crash when 1588 is received on HIP08 devices\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0bf5eb788512187b744ef7f79de835e6cbe85b9c\", \"lessThan\": \"23ec1cec24293f9799c725941677d4e167997265\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0bf5eb788512187b744ef7f79de835e6cbe85b9c\", \"lessThan\": \"b3cf70472a600bcb2efe24906bc9bc6014d4c6f6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0bf5eb788512187b744ef7f79de835e6cbe85b9c\", \"lessThan\": \"f0b5225a7dfc1bf53c98215db8c2f0b4efd3f108\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0bf5eb788512187b744ef7f79de835e6cbe85b9c\", \"lessThan\": \"b2bb19114c079dcfec1ea46e761f510e30505e70\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0bf5eb788512187b744ef7f79de835e6cbe85b9c\", \"lessThan\": \"11b998360d96f6c76f04a95f54b49f24d3c858e4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0bf5eb788512187b744ef7f79de835e6cbe85b9c\", \"lessThan\": \"0fbcf2366ba9888cf02eda23e35fde7f7fcc07c3\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.153\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.23\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/23ec1cec24293f9799c725941677d4e167997265\"}, {\"url\": \"https://git.kernel.org/stable/c/b3cf70472a600bcb2efe24906bc9bc6014d4c6f6\"}, {\"url\": \"https://git.kernel.org/stable/c/f0b5225a7dfc1bf53c98215db8c2f0b4efd3f108\"}, {\"url\": \"https://git.kernel.org/stable/c/b2bb19114c079dcfec1ea46e761f510e30505e70\"}, {\"url\": \"https://git.kernel.org/stable/c/11b998360d96f6c76f04a95f54b49f24d3c858e4\"}, {\"url\": \"https://git.kernel.org/stable/c/0fbcf2366ba9888cf02eda23e35fde7f7fcc07c3\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: hns3: fix kernel crash when 1588 is received on HIP08 devices\\n\\nThe HIP08 devices does not register the ptp devices, so the\\nhdev-\u003eptp is NULL, but the hardware can receive 1588 messages,\\nand set the HNS3_RXD_TS_VLD_B bit, so, if match this case, the\\naccess of hdev-\u003eptp-\u003eflags will cause a kernel crash:\\n\\n[ 5888.946472] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018\\n[ 5888.946475] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018\\n...\\n[ 5889.266118] pc : hclge_ptp_get_rx_hwts+0x40/0x170 [hclge]\\n[ 5889.272612] lr : hclge_ptp_get_rx_hwts+0x34/0x170 [hclge]\\n[ 5889.279101] sp : ffff800012c3bc50\\n[ 5889.283516] x29: ffff800012c3bc50 x28: ffff2040002be040\\n[ 5889.289927] x27: ffff800009116484 x26: 0000000080007500\\n[ 5889.296333] x25: 0000000000000000 x24: ffff204001c6f000\\n[ 5889.302738] x23: ffff204144f53c00 x22: 0000000000000000\\n[ 5889.309134] x21: 0000000000000000 x20: ffff204004220080\\n[ 5889.315520] x19: ffff204144f53c00 x18: 0000000000000000\\n[ 5889.321897] x17: 0000000000000000 x16: 0000000000000000\\n[ 5889.328263] x15: 0000004000140ec8 x14: 0000000000000000\\n[ 5889.334617] x13: 0000000000000000 x12: 00000000010011df\\n[ 5889.340965] x11: bbfeff4d22000000 x10: 0000000000000000\\n[ 5889.347303] x9 : ffff800009402124 x8 : 0200f78811dfbb4d\\n[ 5889.353637] x7 : 2200000000191b01 x6 : ffff208002a7d480\\n[ 5889.359959] x5 : 0000000000000000 x4 : 0000000000000000\\n[ 5889.366271] x3 : 0000000000000000 x2 : 0000000000000000\\n[ 5889.372567] x1 : 0000000000000000 x0 : ffff20400095c080\\n[ 5889.378857] Call trace:\\n[ 5889.382285] hclge_ptp_get_rx_hwts+0x40/0x170 [hclge]\\n[ 5889.388304] hns3_handle_bdinfo+0x324/0x410 [hns3]\\n[ 5889.394055] hns3_handle_rx_bd+0x60/0x150 [hns3]\\n[ 5889.399624] hns3_clean_rx_ring+0x84/0x170 [hns3]\\n[ 5889.405270] hns3_nic_common_poll+0xa8/0x220 [hns3]\\n[ 5889.411084] napi_poll+0xcc/0x264\\n[ 5889.415329] net_rx_action+0xd4/0x21c\\n[ 5889.419911] __do_softirq+0x130/0x358\\n[ 5889.424484] irq_exit+0x134/0x154\\n[ 5889.428700] __handle_domain_irq+0x88/0xf0\\n[ 5889.433684] gic_handle_irq+0x78/0x2c0\\n[ 5889.438319] el1_irq+0xb8/0x140\\n[ 5889.442354] arch_cpu_idle+0x18/0x40\\n[ 5889.446816] default_idle_call+0x5c/0x1c0\\n[ 5889.451714] cpuidle_idle_call+0x174/0x1b0\\n[ 5889.456692] do_idle+0xc8/0x160\\n[ 5889.460717] cpu_startup_entry+0x30/0xfc\\n[ 5889.465523] secondary_start_kernel+0x158/0x1ec\\n[ 5889.470936] Code: 97ffab78 f9411c14 91408294 f9457284 (f9400c80)\\n[ 5889.477950] SMP: stopping secondary CPUs\\n[ 5890.514626] SMP: failed to stop secondary CPUs 0-69,71-95\\n[ 5890.522951] Starting crashdump kernel...\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T08:49:24.132Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26881\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T08:49:24.132Z\", \"dateReserved\": \"2024-02-19T14:20:24.185Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-17T10:27:37.744Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.