In the Linux kernel, the following vulnerability has been resolved:
ice: Fix increasing MSI-X on VF
Increasing MSI-X value on a VF leads to invalid memory operations. This is caused by not reallocating some arrays.
Reproducer: modprobe ice echo 0 > /sys/bus/pci/devices/$PFPCI/sriovdriversautoprobe echo 1 > /sys/bus/pci/devices/$PFPCI/sriovnumvfs echo 17 > /sys/bus/pci/devices/$VF0PCI/sriovvfmsix_count
Default MSI-X is 16, so 17 and above triggers this issue.
KASAN reports:
BUG: KASAN: slab-out-of-bounds in icevsiallocringstats+0x38d/0x4b0 [ice] Read of size 8 at addr ffff8888b937d180 by task bash/28433 (...)
Call Trace: (...) ? icevsiallocringstats+0x38d/0x4b0 [ice] kasanreport+0xed/0x120 ? icevsiallocringstats+0x38d/0x4b0 [ice] icevsiallocringstats+0x38d/0x4b0 [ice] icevsicfgdef+0x3360/0x4770 [ice] ? mutexunlock+0x83/0xd0 ? _pfxicevsicfgdef+0x10/0x10 [ice] ? _pfxiceremovevsilkupfltr+0x10/0x10 [ice] icevsicfg+0x7f/0x3b0 [ice] icevfreconfigvsi+0x114/0x210 [ice] icesriovsetmsixveccount+0x3d0/0x960 [ice] sriovvfmsixcountstore+0x21c/0x300 (...)
Allocated by task 28201: (...) icevsicfgdef+0x1c8e/0x4770 [ice] icevsicfg+0x7f/0x3b0 [ice] icevsisetup+0x179/0xa30 [ice] icesriovconfigure+0xcaa/0x1520 [ice] sriovnumvfs_store+0x212/0x390 (...)
To fix it, use icevsirebuild() instead of icevfreconfigvsi(). This causes the required arrays to be reallocated taking the new queue count into account (icevsireallocstatarrays()). Set reqtxq and reqrxq before icevsi_rebuild(), so that realloc uses the newly set queue count.
Additionally, icevsirebuild() does not remove VSI filters (icefltrremoveall()), so icevfinithost_cfg() is no longer necessary.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50042.json"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-50042.json"
[
{
"digest": {
"function_hash": "252354488444672529592774737101996112376",
"length": 1813.0
},
"signature_version": "v1",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_sriov.c",
"function": "ice_sriov_set_msix_vec_count"
},
"signature_type": "Function",
"id": "CVE-2024-50042-1dc9fde7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bce9af1b030bf59d51bbabf909a3ef164787e44e",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"261491486504437442706481502240602955724",
"261121259950052647453250124517750966821",
"322975606996633647887038096621308634645",
"167482257207848613068838088196843296991",
"308324284724828075117184473390317299677",
"79090593340726401297507035438844833368",
"62424673810035995305310923418665241206",
"128276296711597205722646601110747226067",
"171065783045252521741905933061230978114"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_sriov.c"
},
"signature_type": "Line",
"id": "CVE-2024-50042-467feb1f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbda6197929418fabf0e45ecf9b7a76360944c70",
"deprecated": false
},
{
"digest": {
"function_hash": "208767533090876861791394743014884362756",
"length": 1767.0
},
"signature_version": "v1",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_sriov.c",
"function": "ice_sriov_set_msix_vec_count"
},
"signature_type": "Function",
"id": "CVE-2024-50042-8d5ca8c2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbda6197929418fabf0e45ecf9b7a76360944c70",
"deprecated": false
},
{
"digest": {
"function_hash": "154857864876019828004577201974940880343",
"length": 404.0
},
"signature_version": "v1",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_vf_lib.c",
"function": "ice_vf_reconfig_vsi"
},
"signature_type": "Function",
"id": "CVE-2024-50042-97a0ac10",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbda6197929418fabf0e45ecf9b7a76360944c70",
"deprecated": false
},
{
"digest": {
"function_hash": "154857864876019828004577201974940880343",
"length": 404.0
},
"signature_version": "v1",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_vf_lib.c",
"function": "ice_vf_reconfig_vsi"
},
"signature_type": "Function",
"id": "CVE-2024-50042-b504bbf6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bce9af1b030bf59d51bbabf909a3ef164787e44e",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"244136796469672002349763559220050951992",
"91141408054880502303401944032119041336",
"90143917972785094241199677905656591922",
"18631047979494753011650560338024273677"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_vf_lib.c"
},
"signature_type": "Line",
"id": "CVE-2024-50042-b8926aa9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbda6197929418fabf0e45ecf9b7a76360944c70",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"164661590887087936680352235440094585596",
"68119811777905698477530798200938760090",
"293281330003666696580738937800506004476",
"309688560351077351680112335342175999198"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_vf_lib_private.h"
},
"signature_type": "Line",
"id": "CVE-2024-50042-d3f8dcd1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbda6197929418fabf0e45ecf9b7a76360944c70",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"164661590887087936680352235440094585596",
"68119811777905698477530798200938760090",
"293281330003666696580738937800506004476",
"309688560351077351680112335342175999198"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_vf_lib_private.h"
},
"signature_type": "Line",
"id": "CVE-2024-50042-e9a7bf5e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bce9af1b030bf59d51bbabf909a3ef164787e44e",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"244136796469672002349763559220050951992",
"91141408054880502303401944032119041336",
"90143917972785094241199677905656591922",
"18631047979494753011650560338024273677"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_vf_lib.c"
},
"signature_type": "Line",
"id": "CVE-2024-50042-f8f2169b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bce9af1b030bf59d51bbabf909a3ef164787e44e",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"261491486504437442706481502240602955724",
"261121259950052647453250124517750966821",
"322975606996633647887038096621308634645",
"167482257207848613068838088196843296991",
"113558688205478776196418326675120825361",
"211050915540410189731978382043220849597",
"62424673810035995305310923418665241206",
"128276296711597205722646601110747226067",
"171065783045252521741905933061230978114"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/net/ethernet/intel/ice/ice_sriov.c"
},
"signature_type": "Line",
"id": "CVE-2024-50042-faf8aaa7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bce9af1b030bf59d51bbabf909a3ef164787e44e",
"deprecated": false
}
]