CVE-2024-50020

What it actually does

Reference count leak in ice_sriov_set_msix_vec_count() due to missing ice_put_vf() calls on error paths after ice_get_vf_by_id() when ice_get_vf_vsi() returns NULL or ice_sriov_get_irqs() fails.

Why it matters to the business

Potential kernel memory exhaustion or instability in SR-IOV enabled network environments, increasing risk of system crashes or degraded performance on Linux hosts handling virtual functions.

How an attack unfolds

An attacker with local access or control over VF configuration triggers the error paths in ice_sriov_set_msix_vec_count() by supplying invalid VSI or IRQ conditions, causing repeated refcount leaks that accumulate without decrement, potentially leading to resource exhaustion over time.

How to fix it

Update the Linux kernel to include commit e8f897f4afef0031fe618a8e94127a0934896aba which adds the missing ice_put_vf(vf) calls on the identified error paths.

How to confirm the fix worked

Verify the presence of commit e8f897f4afef0031fe618a8e94127a0934896aba in the kernel source or confirm the patched ice_sriov_set_msix_vec_count() implementation; test SR-IOV VF vector count changes under error conditions.

Typical attack path

1. Obtain local execution or VF management privileges on affected Linux kernel
2. Invoke or manipulate ice_sriov_set_msix_vec_count() via SR-IOV interface with conditions causing ice_get_vf_vsi() or ice_sriov_get_irqs() to fail
3. Repeat triggering to accumulate reference count leaks
4. Observe resulting memory pressure or kernel instability

How to detect it

Review kernel logs for ice driver errors around VF initialization and monitor for unexpected increases in memory usage or reference count warnings; no specific post-exploitation artifacts are known.

What your security team should do

• Prioritize kernel upgrade to the fixed commit for systems using Intel ice driver with SR-IOV
• Monitor kernel memory usage and refcount-related warnings in dmesg on affected hosts
• Restrict unprivileged access to SR-IOV configuration interfaces until patched