Junglewise Threat Intelligence

CVE-2024-39502: Linux Kernel ionic use-after-free in ionic_qcq_enable

CVE-2024-39502 · Severity: high · CVSS 7.8 · Published 2024-07-12

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's ionic network driver could allow a local user to cause a system crash. The issue occurs when reconfiguring network queues, leading the system to attempt to use a component that has already been removed. This results in a 'kernel bug' error and immediate system instability or shutdown, potentially disrupting operations and availability.

Technical details

A use-after-free vulnerability exists in the ionic network driver due to improper state tracking after calling netif_napi_del(). When network queues are reconfigured (e.g., via ethtool), the driver checks the .poll pointer to determine if a NAPI instance is active. However, netif_napi_del() does not reset this pointer to NULL. Consequently, ionic_qcq_enable() may attempt to call napi_enable() on an unregistered queue, triggering a kernel BUG at net/core/dev.c. This can be exploited by a local user with sufficient privileges to modify network configurations to cause a Denial of Service (DoS). Patches have been released for multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 5.4 to 5.4.279, 5.5 to 5.10.221, 5.11 to 5.15.162, 5.16 to 6.1.95, 6.2 to 6.6.35, 6.7 to 6.9.6, 6.10-rc1 to 6.10-rc3

Timeline

  • 2024-06-12: disclosed: Initial patch submission
  • 2024-07-05: patched: Patch committed to stable tree
  • 2024-07-12: advisory: CVE-2024-39502 published

References

Related threats