CVE-2024-50042

What it actually does

Out-of-bounds read in ice_vsi_alloc_ring_stats when MSI-X count on an ice VF is raised above the default 16; arrays allocated at VSI setup time are not reallocated, leading to slab corruption.

Why it matters to the business

Systems using the Intel ice Ethernet driver with SR-IOV enabled can experience kernel memory corruption or crashes when VF MSI-X counts are increased, affecting network virtualization and stability on affected Linux kernels.

How an attack unfolds

An attacker with local access writes a value of 17 or higher to /sys/bus/pci/devices/$VF0_PCI/sriov_vf_msix_count; the ice driver calls ice_sriov_set_msix_vec_count which invokes ice_vf_reconfig_vsi without reallocating ring statistics arrays, triggering a KASAN-detected slab-out-of-bounds read during ice_vsi_cfg_def.

How to fix it

Apply the upstream fix in commit e8f897f4afef0031fe618a8e94127a0934896aba or later; rebuild and boot a kernel containing this commit. Recompile any out-of-tree ice modules against the patched source.

How to confirm the fix worked

Confirm the running kernel contains commit e8f897f4afef; attempt the published reproducer with KASAN enabled and verify no slab-out-of-bounds reports occur; check that ice_vsi_rebuild is used instead of ice_vf_reconfig_vsi in the driver source.

Typical attack path

1. Load ice module and disable driver autoprobe on PF
2. Create at least one VF via sriov_numvfs
3. Write value >=17 to the VF's sriov_vf_msix_count sysfs attribute
4. Kernel performs ice_vsi_reconfig without reallocating stats arrays
5. ice_vsi_alloc_ring_stats performs out-of-bounds read, corrupting slab memory

How to detect it

Search kernel logs and KASAN reports for the function ice_vsi_alloc_ring_stats and the call stack containing ice_sriov_set_msix_vec_count or sriov_vf_msix_count_store; look for writes to sriov_vf_msix_count sysfs entries followed immediately by crashes.

• ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice]
• sriov_vf_msix_count_store
• ice_sriov_set_msix_vec_count
• BUG: KASAN: slab-out-of-bounds in ice_vsi_alloc_ring_stats
• /sys/bus/pci/devices/*/sriov_vf_msix_count

What your security team should do

• Prioritize patching production kernels that load the ice driver and expose SR-IOV VFs
• Restrict write access to sriov_vf_msix_count sysfs files via SELinux or file permissions until patched
• Monitor for KASAN or kernel oops reports referencing ice_vsi_alloc_ring_stats
• Plan staged rollout of fixed kernels across fleets using the ice driver