CVE-2024-40907: ionic: fix kernel panic in XDP_TX action
In the Linux kernel, the following vulnerability has been resolved:
ionic: fix kernel panic in XDPTX action
In the XDPTX path, ionic driver sends a packet to the TX path with rx page and corresponding dma address. After tx is done, ionictxclean() frees that page. But RX ring buffer isn't reset to NULL. So, it uses a freed page, which causes kernel panic.
BUG: unable to handle page fault for address: ffff8881576c110c PGD 773801067 P4D 773801067 PUD 87f086067 PMD 87efca067 PTE 800ffffea893e060 Oops: Oops: 0000 [#1] PREEMPT SMP DEBUGPAGEALLOC KASAN NOPTI CPU: 1 PID: 25 Comm: ksoftirqd/1 Not tainted 6.9.0+ #11 Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 RIP: 0010:bpfprogf0b8caeac1068a55balanceringress+0x3b/0x44f Code: 00 53 41 55 41 56 41 57 b8 01 00 00 00 48 8b 5f 08 4c 8b 77 00 4c 89 f7 48 83 c7 0e 48 39 d8 RSP: 0018:ffff888104e6fa28 EFLAGS: 00010283 RAX: 0000000000000002 RBX: ffff8881576c1140 RCX: 0000000000000002 RDX: ffffffffc0051f64 RSI: ffffc90002d33048 RDI: ffff8881576c110e RBP: ffff888104e6fa88 R08: 0000000000000000 R09: ffffed1027a04a23 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881b03a21a8 R13: ffff8881589f800f R14: ffff8881576c1100 R15: 00000001576c1100 FS: 0000000000000000(0000) GS:ffff88881ae00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8881576c110c CR3: 0000000767a90000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <TASK> ? die+0x20/0x70 ? pagefaultoops+0x254/0x790 ? pfxpagefaultoops+0x10/0x10 ? pfxisprefetch.constprop.0+0x10/0x10 ? searchbpfextables+0x165/0x260 ? fixupexception+0x4a/0x970 ? excpagefault+0xcb/0xe0 ? asmexcpagefault+0x22/0x30 ? 0xffffffffc0051f64 ? bpfprogf0b8caeac1068a55balanceringress+0x3b/0x44f ? dorawspinunlock+0x54/0x220 ionicrxservice+0x11ab/0x3010 [ionic 9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ? ionictxclean+0x29b/0xc60 [ionic 9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ? pfxionictxclean+0x10/0x10 [ionic 9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ? pfxionicrxservice+0x10/0x10 [ionic 9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ? ionictxcqservice+0x25d/0xa00 [ionic 9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ? pfxionicrxservice+0x10/0x10 [ionic 9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ioniccqservice+0x69/0x150 [ionic 9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ionictxrxnapi+0x11a/0x540 [ionic 9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] napipoll.constprop.0+0xa0/0x440 netrxaction+0x7e7/0xc30 ? pfxnetrxaction+0x10/0x10
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ionic: fix kernel panic in XDPTX action
In the XDPTX path, ionic driver sends a packet to the TX path with rx page and corresponding dma address. After tx is done, ionictxclean() frees that page. But RX ring buffer isn't reset to NULL. So, it uses a freed page, which causes kernel panic.
BUG: unable to handle page fault for address: ffff8881576c110c PGD 773801067 P4D 773801067 PUD 87f086067 PMD 87efca067 PTE 800ffffea893e060 Oops: Oops: 0000 [#1] PREEMPT SMP DEBUGPAGEALLOC KASAN NOPTI CPU: 1 PID: 25 Comm: ksoftirqd/1 Not tainted 6.9.0+ #11 Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 RIP: 0010:bpfprogf0b8caeac1068a55balanceringress+0x3b/0x44f Code: 00 53 41 55 41 56 41 57 b8 01 00 00 00 48 8b 5f 08 4c 8b 77 00 4c 89 f7 48 83 c7 0e 48 39 d8 RSP: 0018:ffff888104e6fa28 EFLAGS: 00010283 RAX: 0000000000000002 RBX: ffff8881576c1140 RCX: 0000000000000002 RDX: ffffffffc0051f64 RSI: ffffc90002d33048 RDI: ffff8881576c110e RBP: ffff888104e6fa88 R08: 0000000000000000 R09: ffffed1027a04a23 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881b03a21a8 R13: ffff8881589f800f R14: ffff8881576c1100 R15: 00000001576c1100 FS: 0000000000000000(0000) GS:ffff88881ae00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8881576c110c CR3: 0000000767a90000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <TASK> ? die+0x20/0x70 ? pagefaultoops+0x254/0x790 ? pfxpagefaultoops+0x10/0x10 ? pfxisprefetch.constprop.0+0x10/0x10 ? searchbpfextables+0x165/0x260 ? fixupexception+0x4a/0x970 ? excpagefault+0xcb/0xe0 ? asmexcpagefault+0x22/0x30 ? 0xffffffffc0051f64 ? bpfprogf0b8caeac1068a55balanceringress+0x3b/0x44f ? dorawspinunlock+0x54/0x220 ionicrxservice+0x11ab/0x3010 [ionic 9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ? ionictxclean+0x29b/0xc60 [ionic 9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ? pfxionictxclean+0x10/0x10 [ionic 9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ? pfxionicrxservice+0x10/0x10 [ionic 9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ? ionictxcqservice+0x25d/0xa00 [ionic 9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ? pfxionicrxservice+0x10/0x10 [ionic 9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ioniccqservice+0x69/0x150 [ionic 9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ionictxrxnapi+0x11a/0x540 [ionic 9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] napipoll.constprop.0+0xa0/0x440 netrxaction+0x7e7/0xc30 ? pfxnetrxaction+0x10/0x10
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9.6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40907?
CVE-2024-40907 has a severity rating that indicates it can cause a kernel panic in affected systems.
How do I fix CVE-2024-40907?
To fix CVE-2024-40907, upgrade the kernel to version 6.9.6 or 6.10 or any later unaffected version.
Which systems are affected by CVE-2024-40907?
CVE-2024-40907 affects Linux kernel versions prior to 6.9.6 and 6.10, including RC versions.
What type of vulnerability is CVE-2024-40907?
CVE-2024-40907 is a buffer management issue that can lead to a kernel panic when using the ionic driver in certain packet send operations.
Is there a known exploit for CVE-2024-40907?
As of now, there are no known public exploits for CVE-2024-40907, but it is recommended to patch the vulnerability to mitigate any risk.