CVE-2024-44932 (GCVE-0-2024-44932)

Vulnerability from cvelistv5 – Published: 2024-08-26 10:11 – Updated: 2025-05-04 09:29
VLAI?
Title
idpf: fix UAFs when destroying the queues
Summary
In the Linux kernel, the following vulnerability has been resolved: idpf: fix UAFs when destroying the queues The second tagged commit started sometimes (very rarely, but possible) throwing WARNs from net/core/page_pool.c:page_pool_disable_direct_recycling(). Turned out idpf frees interrupt vectors with embedded NAPIs *before* freeing the queues making page_pools' NAPI pointers lead to freed memory before these pools are destroyed by libeth. It's not clear whether there are other accesses to the freed vectors when destroying the queues, but anyway, we usually free queue/interrupt vectors only when the queues are destroyed and the NAPIs are guaranteed to not be referenced anywhere. Invert the allocation and freeing logic making queue/interrupt vectors be allocated first and freed last. Vectors don't require queues to be present, so this is safe. Additionally, this change allows to remove that useless queue->q_vector pointer cleanup, as vectors are still valid when freeing the queues (+ both are freed within one function, so it's not clear why nullify the pointers at all).
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 1c325aac10a82f11410da8a2bf35e3e410a42751 , < 3cde714b0e77206ed1b5cf31f28c18ba9ae946fd (git)
Affected: 1c325aac10a82f11410da8a2bf35e3e410a42751 , < 290f1c033281c1a502a3cd1c53c3a549259c491f (git)
Create a notification for this product.
    Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.10.5 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-44932",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:27:58.052745Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:06.917Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/idpf/idpf_lib.c",
            "drivers/net/ethernet/intel/idpf/idpf_txrx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3cde714b0e77206ed1b5cf31f28c18ba9ae946fd",
              "status": "affected",
              "version": "1c325aac10a82f11410da8a2bf35e3e410a42751",
              "versionType": "git"
            },
            {
              "lessThan": "290f1c033281c1a502a3cd1c53c3a549259c491f",
              "status": "affected",
              "version": "1c325aac10a82f11410da8a2bf35e3e410a42751",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/idpf/idpf_lib.c",
            "drivers/net/ethernet/intel/idpf/idpf_txrx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.5",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: fix UAFs when destroying the queues\n\nThe second tagged commit started sometimes (very rarely, but possible)\nthrowing WARNs from\nnet/core/page_pool.c:page_pool_disable_direct_recycling().\nTurned out idpf frees interrupt vectors with embedded NAPIs *before*\nfreeing the queues making page_pools\u0027 NAPI pointers lead to freed\nmemory before these pools are destroyed by libeth.\nIt\u0027s not clear whether there are other accesses to the freed vectors\nwhen destroying the queues, but anyway, we usually free queue/interrupt\nvectors only when the queues are destroyed and the NAPIs are guaranteed\nto not be referenced anywhere.\n\nInvert the allocation and freeing logic making queue/interrupt vectors\nbe allocated first and freed last. Vectors don\u0027t require queues to be\npresent, so this is safe. Additionally, this change allows to remove\nthat useless queue-\u003eq_vector pointer cleanup, as vectors are still\nvalid when freeing the queues (+ both are freed within one function,\nso it\u0027s not clear why nullify the pointers at all)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T09:29:10.322Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3cde714b0e77206ed1b5cf31f28c18ba9ae946fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/290f1c033281c1a502a3cd1c53c3a549259c491f"
        }
      ],
      "title": "idpf: fix UAFs when destroying the queues",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-44932",
    "datePublished": "2024-08-26T10:11:23.115Z",
    "dateReserved": "2024-08-21T05:34:56.664Z",
    "dateUpdated": "2025-05-04T09:29:10.322Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-44932\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:27:58.052745Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.918Z\"}}], \"cna\": {\"title\": \"idpf: fix UAFs when destroying the queues\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1c325aac10a82f11410da8a2bf35e3e410a42751\", \"lessThan\": \"3cde714b0e77206ed1b5cf31f28c18ba9ae946fd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1c325aac10a82f11410da8a2bf35e3e410a42751\", \"lessThan\": \"290f1c033281c1a502a3cd1c53c3a549259c491f\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/intel/idpf/idpf_lib.c\", \"drivers/net/ethernet/intel/idpf/idpf_txrx.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/intel/idpf/idpf_lib.c\", \"drivers/net/ethernet/intel/idpf/idpf_txrx.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3cde714b0e77206ed1b5cf31f28c18ba9ae946fd\"}, {\"url\": \"https://git.kernel.org/stable/c/290f1c033281c1a502a3cd1c53c3a549259c491f\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nidpf: fix UAFs when destroying the queues\\n\\nThe second tagged commit started sometimes (very rarely, but possible)\\nthrowing WARNs from\\nnet/core/page_pool.c:page_pool_disable_direct_recycling().\\nTurned out idpf frees interrupt vectors with embedded NAPIs *before*\\nfreeing the queues making page_pools\u0027 NAPI pointers lead to freed\\nmemory before these pools are destroyed by libeth.\\nIt\u0027s not clear whether there are other accesses to the freed vectors\\nwhen destroying the queues, but anyway, we usually free queue/interrupt\\nvectors only when the queues are destroyed and the NAPIs are guaranteed\\nto not be referenced anywhere.\\n\\nInvert the allocation and freeing logic making queue/interrupt vectors\\nbe allocated first and freed last. Vectors don\u0027t require queues to be\\npresent, so this is safe. Additionally, this change allows to remove\\nthat useless queue-\u003eq_vector pointer cleanup, as vectors are still\\nvalid when freeing the queues (+ both are freed within one function,\\nso it\u0027s not clear why nullify the pointers at all).\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:18:23.809Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-44932\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:18:23.809Z\", \"dateReserved\": \"2024-08-21T05:34:56.664Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-26T10:11:23.115Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.