Cloudanix VulnDB

CVE-2024-50296

None

CVSS

—

EPSS

0.3%

Published

Nov 19, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in certain Linux network drivers can crash the whole computer if someone removes the driver at the exact same time virtual network functions are being turned off.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Concurrent calls to pci_disable_sriov during driver removal and VF disable race on num_VFs check, leading to double resource release and NULL pointer dereference in klist_put during device_del.

Why it matters to the business

System crashes on affected network hardware during driver unload or SR-IOV reconfiguration, disrupting network connectivity and requiring manual recovery or reboot.

How an attack unfolds

An attacker with local access triggers the race by running rmmod on the hclge/hnae3 module while another process calls sriov_numvfs_store to disable VFs, causing the second pci_disable_sriov path to dereference already-freed structures.

How to fix it

Update to Linux kernel containing commit 8bb7eca972ad531c9b149c0a51ab43a417385813 or later; ensure device_lock serializes num_VFs checks during hnae3_unregister_ae_algo_prepare and sriov_numvfs_store.

How to confirm the fix worked

Verify presence of the locking change around pci_disable_sriov in hclge_exit and confirm num_VFs is protected before sriov_del_vfs; test concurrent rmmod and VF disable without crash.

Typical attack path

  1. Obtain local shell or module unload privileges on target system
  2. Concurrently invoke driver removal (rmmod hclge) and VF disable via sysfs or pci config
  3. Trigger duplicate sriov_disable path without device_lock protection on num_VFs
  4. Induce klist_put on freed device structure resulting in kernel panic

How to detect it

Inspect kernel logs for NULL pointer dereference traces containing klist_put, device_del, pci_iov_remove_virtfn and hnae3_unregister_ae_algo_prepare during module unload; correlate with concurrent sriov_numvfs_store activity.

What your security team should do

  • Prioritize kernel upgrade on systems using hns3/hclge SR-IOV
  • Restrict local module unload and sysfs VF configuration to trusted users
  • Monitor for kernel oops involving klist_put or pci_remove_bus_device during driver removal

The record

In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when uninstalling driver When the driver is uninstalled and the VF is disabled concurrently, a kernel crash occurs. The reason is that the two actions call function pci_disable_sriov(). The num_VFs is checked to determine whether to release the corresponding resources. During the second calling, num_VFs is not 0 and the resource release function is called. However, the corresponding resource has been released during the first invoking. Therefore, the problem occurs: [15277.839633][T50670] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 ... [15278.131557][T50670] Call trace: [15278.134686][T50670] klist_put+0x28/0x12c [15278.138682][T50670] klist_del+0x14/0x20 [15278.142592][T50670] device_del+0xbc/0x3c0 [15278.146676][T50670] pci_remove_bus_device+0x84/0x120 [15278.151714][T50670] pci_stop_and_remove_bus_device+0x6c/0x80 [15278.157447][T50670] pci_iov_remove_virtfn+0xb4/0x12c [15278.162485][T50670] sriov_disable+0x50/0x11c [15278.166829][T50670] pci_disable_sriov+0x24/0x30 [15278.171433][T50670] hnae3_unregister_ae_algo_prepare+0x60/0x90 [hnae3] [15278.178039][T50670] hclge_exit+0x28/0xd0 [hclge] [15278.182730][T50670] __se_sys_delete_module.isra.0+0x164/0x230 [15278.188550][T50670] __arm64_sys_delete_module+0x1c/0x30 [15278.193848][T50670] invoke_syscall+0x50/0x11c [15278.198278][T50670] el0_svc_common.constprop.0+0x158/0x164 [15278.203837][T50670] do_el0_svc+0x34/0xcc [15278.207834][T50670] el0_svc+0x20/0x30 For details, see the following figure. rmmod hclge disable VFs ---------------------------------------------------- hclge_exit() sriov_numvfs_store() ... device_lock() pci_disable_sriov() hns3_pci_sriov_configure() pci_disable_sriov() sriov_disable() sriov_disable() if !num_VFs : if !num_VFs : return; return; sriov_del_vfs() sriov_del_vfs() ... ... klist_put() klist_put() ... ... num_VFs = 0; num_VFs = 0; device_unlock(); In this patch, when driver is removing, we get the device_lock() to protect num_VFs, just like sriov_numvfs_store().

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 No fix
Debian:11 linux 0 5.10.234-1
Debian:11 linux-6.1 0 6.1.119-1~deb11u1
Debian:12 linux 0 No fix
Debian:12 linux 0 6.1.119-1
Debian:13 linux 0 No fix
Debian:13 linux 0 6.11.9-1
Linux Kernel 0 4.19.324
SUSE:Linux Enterprise High Availability Extension 12 SP5 kernel-default 0 4.12.14-122.237.1
SUSE:Linux Enterprise High Availability Extension 15 SP6 kernel-default 0 6.4.0-150600.23.30.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-64kb 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-default 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-default-base 0 5.14.21-150500.55.91.1.150500.6.41.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-docs 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-obs-build 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-source 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-syms 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-64kb 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-default 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-default-base 0 5.14.21-150500.55.91.1.150500.6.41.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-docs 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-obs-build 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-source 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-syms 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise Live Patching 12 SP5 kernel-default 0 4.12.14-122.237.1
SUSE:Linux Enterprise Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_63 0 1-8.3.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-default 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_22 0 1-150500.11.3.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-default 0 6.4.0-150600.23.30.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_6 0 1-150600.1.3.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_6 0 1-150600.13.3.5
SUSE:Linux Enterprise Micro 5.5 kernel-default 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise Micro 5.5 kernel-default-base 0 5.14.21-150500.55.91.1.150500.6.41.1
SUSE:Linux Enterprise Micro 5.5 kernel-rt 0 5.14.21-150500.13.82.1
SUSE:Linux Enterprise Micro 5.5 kernel-source-rt 0 5.14.21-150500.13.82.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-64kb 0 6.4.0-150600.23.30.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default 0 6.4.0-150600.23.30.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default-base 0 6.4.0-150600.23.30.1.150600.12.12.6
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-source 0 6.4.0-150600.23.30.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-zfcpdump 0 6.4.0-150600.23.30.1
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 kernel-coco 0 6.4.0-15061.12.coco15sp6.1
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 kernel-coco_debug 0 6.4.0-15061.12.coco15sp6.1
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 kernel-source-coco 0 6.4.0-15061.12.coco15sp6.1
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 kernel-syms-coco 0 6.4.0-15061.12.coco15sp6.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-docs 0 6.4.0-150600.23.30.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-obs-build 0 6.4.0-150600.23.30.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-source 0 6.4.0-150600.23.30.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-syms 0 6.4.0-150600.23.30.1
SUSE:Linux Enterprise Module for Legacy 15 SP6 kernel-default 0 6.4.0-150600.23.30.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-azure 0 6.4.0-150600.8.20.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-source-azure 0 6.4.0-150600.8.20.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-syms-azure 0 6.4.0-150600.8.20.1
SUSE:Linux Enterprise Server 12 SP5-LTSS kernel-default 0 4.12.14-122.237.1
SUSE:Linux Enterprise Server 12 SP5-LTSS kernel-source 0 4.12.14-122.237.1
SUSE:Linux Enterprise Server 12 SP5-LTSS kernel-syms 0 4.12.14-122.237.1
SUSE:Linux Enterprise Server 15 SP5-LTSS kernel-64kb 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise Server 15 SP5-LTSS kernel-default 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise Server 15 SP5-LTSS kernel-default-base 0 5.14.21-150500.55.91.1.150500.6.41.1
SUSE:Linux Enterprise Server 15 SP5-LTSS kernel-docs 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise Server 15 SP5-LTSS kernel-obs-build 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise Server 15 SP5-LTSS kernel-source 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise Server 15 SP5-LTSS kernel-syms 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise Server 15 SP5-LTSS kernel-zfcpdump 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 kernel-default 0 4.12.14-122.237.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 kernel-source 0 4.12.14-122.237.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 kernel-syms 0 4.12.14-122.237.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 kernel-default 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 kernel-default-base 0 5.14.21-150500.55.91.1.150500.6.41.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 kernel-docs 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 kernel-obs-build 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 kernel-source 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 kernel-syms 0 5.14.21-150500.55.91.1
SUSE:Linux Enterprise Workstation Extension 15 SP6 kernel-default 0 6.4.0-150600.23.30.1
SUSE:Real Time Module 15 SP6 kernel-rt 0 6.4.0-150600.10.20.1
SUSE:Real Time Module 15 SP6 kernel-rt_debug 0 6.4.0-150600.10.20.1
SUSE:Real Time Module 15 SP6 kernel-source-rt 0 6.4.0-150600.10.20.1
SUSE:Real Time Module 15 SP6 kernel-syms-rt 0 6.4.0-150600.10.20.1
Ubuntu:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure 0 No fix
Ubuntu:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:18.04:LTS linux-gcp 0 No fix
Ubuntu:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:18.04:LTS linux-hwe 0 No fix
Ubuntu:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-oem 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:20.04:LTS linux 0 No fix
Ubuntu:20.04:LTS linux 0 5.4.0-208.228
Ubuntu:20.04:LTS linux-aws 0 No fix
Ubuntu:20.04:LTS linux-aws 0 5.4.0-1140.150
Ubuntu:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 5.15.0-1080.87~20.04.1
Ubuntu:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure 0 No fix
Ubuntu:20.04:LTS linux-azure 0 5.4.0-1145.152
Ubuntu:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 5.15.0-1081.90~20.04.1
Ubuntu:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 No fix
Ubuntu:20.04:LTS linux-bluefield 0 No fix
Ubuntu:20.04:LTS linux-bluefield 0 5.4.0-1099.106
Ubuntu:20.04:LTS linux-gcp 0 No fix
Ubuntu:20.04:LTS linux-gcp 0 5.4.0-1143.152
Ubuntu:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 5.15.0-1077.86~20.04.1
Ubuntu:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:20.04:LTS linux-gke 0 No fix
Ubuntu:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 No fix
Ubuntu:20.04:LTS linux-gkeop-5.15 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 5.15.0-134.145~20.04.1
Ubuntu:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 5.4.0-1086.91
Ubuntu:20.04:LTS linux-ibm-5.15 0 No fix
Ubuntu:20.04:LTS linux-ibm-5.15 0 5.15.0-1074.77~20.04.1
Ubuntu:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 5.15.0-1073.79~20.04.2
Ubuntu:20.04:LTS linux-iot 0 No fix
Ubuntu:20.04:LTS linux-iot 0 5.4.0-1048.51
Ubuntu:20.04:LTS linux-kvm 0 No fix
Ubuntu:20.04:LTS linux-kvm 0 5.4.0-1127.136
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 No fix
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 5.15.0-133.143~20.04.1
Ubuntu:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 5.4.0-1138.147
Ubuntu:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 5.15.0-1075.81~20.04.1
Ubuntu:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 5.4.0-1129.142
Ubuntu:20.04:LTS linux-raspi2 0 No fix
Ubuntu:20.04:LTS linux-riscv 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 5.15.0-1073.77~20.04.1
Ubuntu:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 5.4.0-1058.62
Ubuntu:22.04:LTS linux 0 No fix
Ubuntu:22.04:LTS linux 0 5.15.0-133.144
Ubuntu:22.04:LTS linux-allwinner-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws 0 No fix
Ubuntu:22.04:LTS linux-aws 0 5.15.0-1078.85
Ubuntu:22.04:LTS linux-aws-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws-6.2 0 No fix
Ubuntu:22.04:LTS linux-aws-6.5 0 No fix
Ubuntu:22.04:LTS linux-aws-6.8 0 No fix
Ubuntu:22.04:LTS linux-aws-6.8 0 6.8.0-1027.29~22.04.1
Ubuntu:22.04:LTS linux-azure 0 No fix
Ubuntu:22.04:LTS linux-azure 0 5.15.0-1081.90
Ubuntu:22.04:LTS linux-azure-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-6.2 0 No fix
Ubuntu:22.04:LTS linux-azure-6.5 0 No fix
Ubuntu:22.04:LTS linux-azure-6.8 0 No fix
Ubuntu:22.04:LTS linux-azure-6.8 0 6.8.0-1027.32~22.04.1
Ubuntu:22.04:LTS linux-azure-fde 0 No fix
Ubuntu:22.04:LTS linux-azure-fde 0 5.15.0-1081.90.1
Ubuntu:22.04:LTS linux-azure-fde-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 5.15.0-1077.86
Ubuntu:22.04:LTS linux-gcp-5.19 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.5 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.8 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.8 0 6.8.0-1028.30~22.04.1
Ubuntu:22.04:LTS linux-gke 0 No fix
Ubuntu:22.04:LTS linux-gke 0 5.15.0-1075.81
Ubuntu:22.04:LTS linux-gkeop 0 No fix
Ubuntu:22.04:LTS linux-gkeop 0 5.15.0-1060.68
Ubuntu:22.04:LTS linux-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.8 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.8 0 6.8.0-58.60~22.04.1

Related vulnerabilities