CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2024-46770 – ice: Add netif_device_attach/detach into PF reset flow
https://notcve.org/view.php?id=CVE-2024-46770
In the Linux kernel, the following vulnerability has been resolved: ice: Add netif_device_attach/detach into PF reset flow Ethtool callbacks can be executed while reset is in progress and try to access deleted resources, e.g. getting coalesce settings can result in a NULL pointer dereference seen below. Reproduction steps: Once the driver is fully initialized, trigger reset: # echo 1 > /sys/class/net/<interface>/device/reset when reset is in progress try to get coalesce settings using ethtool: # ethtool -c <interface> BUG: kernel NULL pointer dereference, address: 0000000000000020 PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 11 PID: 19713 Comm: ethtool Tainted: G S 6.10.0-rc7+ #7 RIP: 0010:ice_get_q_coalesce+0x2e/0xa0 [ice] RSP: 0018:ffffbab1e9bcf6a8 EFLAGS: 00010206 RAX: 000000000000000c RBX: ffff94512305b028 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff9451c3f2e588 RDI: ffff9451c3f2e588 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: ffff9451c3f2e580 R11: 000000000000001f R12: ffff945121fa9000 R13: ffffbab1e9bcf760 R14: 0000000000000013 R15: ffffffff9e65dd40 FS: 00007faee5fbe740(0000) GS:ffff94546fd80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000020 CR3: 0000000106c2e005 CR4: 00000000001706f0 Call Trace: <TASK> ice_get_coalesce+0x17/0x30 [ice] coalesce_prepare_data+0x61/0x80 ethnl_default_doit+0xde/0x340 genl_family_rcv_msg_doit+0xf2/0x150 genl_rcv_msg+0x1b3/0x2c0 netlink_rcv_skb+0x5b/0x110 genl_rcv+0x28/0x40 netlink_unicast+0x19c/0x290 netlink_sendmsg+0x222/0x490 __sys_sendto+0x1df/0x1f0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x82/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7faee60d8e27 Calling netif_device_detach() before reset makes the net core not call the driver when ethtool command is issued, the attempt to execute an ethtool command during reset will result in the following message: netlink error: No such device instead of NULL pointer dereference. Once reset is done and ice_rebuild() is executing, the netif_device_attach() is called to allow for ethtool operations to occur again in a safe manner. • https://git.kernel.org/stable/c/fcea6f3da546b93050f3534aadea7bd96c1d7349 https://git.kernel.org/stable/c/9e3ffb839249eca113062587659224f856fe14e5 https://git.kernel.org/stable/c/efe8effe138044a4747d1112ebb8c454d1663723 https://git.kernel.org/stable/c/36486c9e8e01b84faaee47203eac0b7e9cc7fa4a https://git.kernel.org/stable/c/d11a67634227f9f9da51938af085fb41a733848f •
CVSS: -EPSS: 0%CPEs: 2EXPL: 0CVE-2024-46769 – spi: intel: Add check devm_kasprintf() returned value
https://notcve.org/view.php?id=CVE-2024-46769
In the Linux kernel, the following vulnerability has been resolved: spi: intel: Add check devm_kasprintf() returned value intel_spi_populate_chip() use devm_kasprintf() to set pdata->name. This can return a NULL pointer on failure but this returned value is not checked. • https://git.kernel.org/stable/c/e58db3bcd93b9e0bf5068a29f7e1a97c29926830 https://git.kernel.org/stable/c/6e68abdc5d674f9f4185bf1e1956368d05df4838 https://git.kernel.org/stable/c/2920294686ec23211637998f3ec386dfd3d784a6 •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-46768 – hwmon: (hp-wmi-sensors) Check if WMI event data exists
https://notcve.org/view.php?id=CVE-2024-46768
In the Linux kernel, the following vulnerability has been resolved: hwmon: (hp-wmi-sensors) Check if WMI event data exists The BIOS can choose to return no event data in response to a WMI event, so the ACPI object passed to the WMI notify handler can be NULL. Check for such a situation and ignore the event in such a case. • https://git.kernel.org/stable/c/23902f98f8d4811ab84dde6419569a5b374f8122 https://git.kernel.org/stable/c/217539e994e53206bbf3fb330261cc78c480d311 https://git.kernel.org/stable/c/4b19c83ba108aa66226da5b79810e4d19e005f12 https://git.kernel.org/stable/c/a54da9df75cd1b4b5028f6c60f9a211532680585 •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-46767 – net: phy: Fix missing of_node_put() for leds
https://notcve.org/view.php?id=CVE-2024-46767
In the Linux kernel, the following vulnerability has been resolved: net: phy: Fix missing of_node_put() for leds The call of of_get_child_by_name() will cause refcount incremented for leds, if it succeeds, it should call of_node_put() to decrease it, fix it. • https://git.kernel.org/stable/c/01e5b728e9e43ae444e0369695a5f72209906464 https://git.kernel.org/stable/c/26928c8f00f6bb0e194f3957fe51c69d36838eb2 https://git.kernel.org/stable/c/d9c8dbbc236cdc6231ee91cdede2fc97b430cfff https://git.kernel.org/stable/c/2560db6ede1aaf162a73b2df43e0b6c5ed8819f7 •
CVSS: -EPSS: 0%CPEs: 2EXPL: 0CVE-2024-46766 – ice: move netif_queue_set_napi to rtnl-protected sections
https://notcve.org/view.php?id=CVE-2024-46766
In the Linux kernel, the following vulnerability has been resolved: ice: move netif_queue_set_napi to rtnl-protected sections Currently, netif_queue_set_napi() is called from ice_vsi_rebuild() that is not rtnl-locked when called from the reset. This creates the need to take the rtnl_lock just for a single function and complicates the synchronization with .ndo_bpf. At the same time, there no actual need to fill napi-to-queue information at this exact point. Fill napi-to-queue information when opening the VSI and clear it when the VSI is being closed. Those routines are already rtnl-locked. Also, rewrite napi-to-queue assignment in a way that prevents inclusion of XDP queues, as this leads to out-of-bounds writes, such as one below. [ +0.000004] BUG: KASAN: slab-out-of-bounds in netif_queue_set_napi+0x1c2/0x1e0 [ +0.000012] Write of size 8 at addr ffff889881727c80 by task bash/7047 [ +0.000006] CPU: 24 PID: 7047 Comm: bash Not tainted 6.10.0-rc2+ #2 [ +0.000004] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021 [ +0.000003] Call Trace: [ +0.000003] <TASK> [ +0.000002] dump_stack_lvl+0x60/0x80 [ +0.000007] print_report+0xce/0x630 [ +0.000007] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ +0.000007] ? • https://git.kernel.org/stable/c/080b0c8d6d261b400f24bb1075fbab8c6daaf69e https://git.kernel.org/stable/c/2285c2faef19ee08a6bd6754f4c3ec07dceb2889 https://git.kernel.org/stable/c/2a5dc090b92cfa5270e20056074241c6db5c9cdd •