Critical Vulnerability in Linux Kernel: Improper Interrupt Context Handling in ntb_netdev
Summary
CVE-2024-42110: In the Linux kernel, the following vulnerability has been resolved: net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from netif_rx() The following is emitted when using idxd (DSA) dmanegine as the data mo... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and extensive hardware support. The ntb_netdev module is responsible for network device management in Non-Transparent Bridging (NTB) environments. This module facilitates communication between devices over a PCIe interconnect, but it has been identified to have a vulnerability related to interrupt context handling, potentially affecting system stability and security.
Vulnerability Detail
The vulnerability, identified as CVE-2024-42110, arises from the ntb_netdev_rx_handler() function incorrectly calling __netif_rx() instead of netif_rx() in a threaded interrupt context. This misuse can lead to system crashes or undefined behavior, as __netif_rx() is designed to be called only from interrupt context. The issue is exacerbated when using the idxd driver with threaded interrupts, which can result in a BUG message indicating improper use of smp_processor_id() in a preemptible context. The root cause is a failure to adhere to the correct context requirements for network packet reception handling, which could lead to severe operational issues.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can modify the ntb_netdev code to replace the call to __netif_rx() with netif_rx() to ensure proper context handling. However, this is not recommended as a long-term solution and should only be used until the kernel can be updated.
Conclusion
CVE-2024-42110 is a critical vulnerability in the Linux kernel that affects the ntb_netdev module's handling of interrupt contexts. Users are strongly advised to update their systems to the latest kernel versions to mitigate the risk of system instability and potential security breaches. For ongoing monitoring, tools like Vulert can be utilized to ensure your applications remain secure.
See every vulnerability recorded for linux →
FAQ
CVE-2024-42110 is a vulnerability in the Linux kernel related to improper handling of interrupt contexts in the ntb_netdev module, which can lead to system instability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file, such as package-lock.json, to check for vulnerabilities.
The vulnerability can cause system crashes, undefined behavior, and may compromise the stability of applications relying on the ntb_netdev module.
Yes, patches are available in the updated versions of the Linux kernel. Users should upgrade to the specified versions for their Debian systems.
If an immediate upgrade is not possible, consider applying the temporary workaround by modifying the ntb_netdev code, but plan to upgrade as soon as feasible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
