CVE-2024-53088

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-53088
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-53088.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-53088
Downstream
Related
Published
2024-11-19T17:45:16.169Z
Modified
2026-03-11T07:50:53.631384Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
i40e: fix race condition by adding filter's intermediate sync state
Details

In the Linux kernel, the following vulnerability has been resolved:

i40e: fix race condition by adding filter's intermediate sync state

Fix a race condition in the i40e driver that leads to MAC/VLAN filters becoming corrupted and leaking. Address the issue that occurs under heavy load when multiple threads are concurrently modifying MAC/VLAN filters by setting mac and port VLAN.

  1. Thread T0 allocates a filter in i40eaddfilter() within i40endosetvfport_vlan().
  2. Thread T1 concurrently frees the filter in __i40edelfilter() within i40endosetvfmac().
  3. Subsequently, i40eservicetask() calls i40esyncvsi_filters(), which refers to the already freed filter memory, causing corruption.

Reproduction steps: 1. Spawn multiple VFs. 2. Apply a concurrent heavy load by running parallel operations to change MAC addresses on the VFs and change port VLANs on the host. 3. Observe errors in dmesg: "Error I40EAQRC_ENOSPC adding RX filters on VF XX, please set promiscuous on manually for VF XX".

Exact code for stable reproduction Intel can't open-source now.

The fix involves implementing a new intermediate filter state, I40EFILTERNEWSYNC, for the time when a filter is on a tmpadd_list. These filters cannot be deleted from the hash list directly but must be removed using the full process.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53088.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
278e7d0b9d6864a9749b9473a273892aa1528621
Fixed
262dc6ea5f1eb18c4d08ad83d51222d0dd0dd42a
Fixed
7ad3fb3bfd43feb4e15c81dffd23ac4e55742791
Fixed
bf5f837d9fd27d32fb76df0a108babcaf4446ff1
Fixed
6e046f4937474bc1b9fa980c1ad8f3253fc638f6
Fixed
f30490e9695ef7da3d0899c6a0293cc7cd373567

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-53088.json"