Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com
☎ 03 60 47 09 81 - info@securiteinfo.com
In the Linux kernel, the following vulnerability has been resolved:ice: move netif_queue_set_napi to rtnl-protected sectionsCurrently, netif_queue_set_napi() is called from ice_vsi_rebuild() that isnot rtnl-locked when called from the reset. This creates the need to takethe rtnl_lock just for a single function and complicates thesynchronization with .ndo_bpf. At the same time, there no actual need tofill napi-to-queue information at this exact point.Fill napi-to-queue information when opening the VSI and clear it when theVSI is being closed. Those routines are already rtnl-locked.Also, rewrite napi-to-queue assignment in a way that prevents inclusion ofXDP queues, as this leads to out-of-bounds writes, such as one below.[ +0.000004] BUG: KASAN: slab-out-of-bounds in netif_queue_set_napi+0x1c2/0x1e0[ +0.000012] Write of size 8 at addr ffff889881727c80 by task bash/7047[ +0.000006] CPU: 24 PID: 7047 Comm: bash Not tainted 6.10.0-rc2+ #2[ +0.000004] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021[ +0.000003] Call Trace:[ +0.000003]
No PoCs from references.
- https://github.com/fkie-cad/nvd-json-data-feeds