CVE-2024-50042: ice: Fix increasing MSI-X on VF
In the Linux kernel, the following vulnerability has been resolved:
ice: Fix increasing MSI-X on VF
Increasing MSI-X value on a VF leads to invalid memory operations. This is caused by not reallocating some arrays.
Reproducer: modprobe ice echo 0 > /sys/bus/pci/devices/$PFPCI/sriovdriversautoprobe echo 1 > /sys/bus/pci/devices/$PFPCI/sriovnumvfs echo 17 > /sys/bus/pci/devices/$VF0PCI/sriovvfmsixcount
Default MSI-X is 16, so 17 and above triggers this issue.
KASAN reports:
BUG: KASAN: slab-out-of-bounds in icevsiallocringstats+0x38d/0x4b0 [ice] Read of size 8 at addr ffff8888b937d180 by task bash/28433 (...)
Call Trace: (...) ? icevsiallocringstats+0x38d/0x4b0 [ice] kasanreport+0xed/0x120 ? icevsiallocringstats+0x38d/0x4b0 [ice] icevsiallocringstats+0x38d/0x4b0 [ice] icevsicfgdef+0x3360/0x4770 [ice] ? mutexunlock+0x83/0xd0 ? pfxicevsicfgdef+0x10/0x10 [ice] ? pfxiceremovevsilkupfltr+0x10/0x10 [ice] icevsicfg+0x7f/0x3b0 [ice] icevfreconfigvsi+0x114/0x210 [ice] icesriovsetmsixveccount+0x3d0/0x960 [ice] sriovvfmsixcountstore+0x21c/0x300 (...)
Allocated by task 28201: (...) icevsicfgdef+0x1c8e/0x4770 [ice] icevsicfg+0x7f/0x3b0 [ice] icevsisetup+0x179/0xa30 [ice] icesriovconfigure+0xcaa/0x1520 [ice] sriovnumvfsstore+0x212/0x390 (...)
To fix it, use icevsirebuild() instead of icevfreconfigvsi(). This causes the required arrays to be reallocated taking the new queue count into account (icevsireallocstatarrays()). Set reqtxq and reqrxq before icevsirebuild(), so that realloc uses the newly set queue count.
Additionally, icevsirebuild() does not remove VSI filters (icefltrremoveall()), so icevfinithostcfg() is no longer necessary.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50042?
CVE-2024-50042 is classified as a moderate severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-50042?
To fix CVE-2024-50042, update your Linux kernel to a version that addresses the issue, specifically versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.16-1.
Which Linux kernel versions are affected by CVE-2024-50042?
CVE-2024-50042 affects Linux kernel versions from 6.7.10 to 6.11.4 and also 6.12-rc1 and 6.12-rc2.
What type of vulnerability is CVE-2024-50042?
CVE-2024-50042 is a memory management vulnerability caused by incorrect handling of arrays in the ice driver within the Linux kernel.
Is a workaround available for CVE-2024-50042?
Currently, there are no specific workarounds suggested for CVE-2024-50042 other than applying the necessary updates.