Mutex Protection Vulnerability in Linux Kernel's ice Package: XDP Configuration Risk
Summary
CVE-2024-46765: In the Linux kernel, the following vulnerability has been resolved: ice: protect XDP configuration with a mutex The main threat to data consistency in ice_xdp() is a possible asynchronous PF reset. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. The 'ice' package is a driver for Intel Ethernet devices, enabling efficient network communication. This package supports advanced features like eXpress Data Path (XDP), which enhances packet processing performance. However, a recent vulnerability has been identified that compromises the integrity of XDP configurations, potentially leading to system crashes.
Vulnerability Detail
In the Linux kernel, specifically within the 'ice' package, a vulnerability exists due to inadequate protection of XDP configuration during asynchronous PF resets. This issue arises when both XDP setup and PF reset code access shared resources without proper synchronization, leading to potential crashes. The vulnerability can be triggered by user actions or system events, such as a transmit timeout handler. The lack of mutex protection around the ice_vsi_rebuild() function allows for race conditions, resulting in kernel NULL pointer dereferences and system instability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid triggering the PF reset during XDP configuration changes. This can be done by ensuring that no transmit timeouts occur while configuring XDP settings. However, this is not a permanent solution and may not be feasible in all environments.
Conclusion
The vulnerability identified in the Linux kernel's ice package poses significant risks to system stability due to inadequate mutex protection during XDP configuration. Implementing the suggested fix is crucial to ensure the integrity of network operations and prevent potential crashes. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes due to kernel NULL pointer dereferences, affecting system stability and performance.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing the manifest file. Visit Vulert Scanner to check if your application is affected.
XDP (eXpress Data Path) is a high-performance packet processing framework in the Linux kernel that allows for fast packet handling directly in the network driver.
While the primary risk is system crashes, data loss may occur if the system is not able to handle ongoing network operations during a crash.
If you cannot apply the fix right away, consider implementing the workaround by avoiding PF resets during XDP configuration changes.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
