CVE-2024-56649

What it actually does

Null pointer dereference in enetc_mm_commit_preemptible_tcs when VF (or unsupported PF) drivers invoke enetc_setup_tc_mqprio; hw->port is NULL so the driver reads from an invalid register address.

Why it matters to the business

Kernel panic and immediate system crash on any attempt to apply mqprio qdisc with hardware offload on affected ENETC virtual functions or certain physical ports, causing denial of service and potential data loss for workloads using these interfaces.

How an attack unfolds

An attacker with CAP_NET_ADMIN runs the tc command to attach an mqprio qdisc with hw 1 on an ENETC VF interface; the shared setup path calls enetc_change_preemptible_tcs which dereferences a NULL pointer and triggers a paging fault that panics the kernel.

How to fix it

Upgrade to a fixed kernel version for each affected package (examples: linux 3.13.0-103.150, 4.4.0-51.72, 4.4.0-1002.2, 4.8.0-36.36~16.04.1, 4.4.0-1038.45, 3.19.0-75.83~14.04.1). After upgrade, reboot and verify the tc command no longer triggers the fault on VFs.

How to confirm the fix worked

Confirm running kernel version matches or exceeds one of the listed fixed packages; attempt the mqprio tc command on a VF and ensure no panic occurs; inspect dmesg for absence of enetc_mm_commit_preemptible_tcs symbols in stack traces.

Typical attack path

1. Locate an ENETC VF netdev
2. Execute tc qdisc add ... mqprio ... hw 1
3. Kernel executes enetc_vf_setup_tc -> enetc_setup_tc_mqprio -> enetc_mm_commit_preemptible_tcs
4. Invalid memory access at 0x1f00 causes panic

How to detect it

Search kernel logs and crash dumps for the symbols enetc_mm_commit_preemptible_tcs, enetc_setup_tc_mqprio, and enetc_vf_setup_tc together with paging fault messages at address 0x1f00.

• enetc_mm_commit_preemptible_tcs+0x1c4/0x400
• Unable to handle kernel paging request at virtual address 0000000000001f00
• enetc_vf_setup_tc+0x1c/0x30
• mqprio_enable_offload+0x144/0x178

What your security team should do

• Apply the listed fixed kernel packages immediately on all Ubuntu 14.04/16.04 systems using ENETC
• Restrict unprivileged use of tc qdisc commands via AppArmor or SELinux until patched
• Add kernel oops monitoring to detect attempted exploitation
• Plan migration off EOL Ubuntu releases