Executive brief
A vulnerability in the Linux kernel's Intel Gigabit Ethernet (igb) driver can cause a system crash (kernel panic) when the network hardware encounters certain PCIe bus errors. This occurs because the driver incorrectly attempts to restart the network interface when it is already active. An attacker with local access could potentially trigger this condition to cause a denial-of-service, disrupting network connectivity and system availability.
Technical details
A logic error exists in the igb driver's error recovery path. Specifically, igb_io_error_detected() was previously modified to ignore non-fatal PCIe errors to prevent hangs during surprise device removal. However, igb_io_resume() assumes the device was brought down if the interface is running. When a transient non-fatal error occurs, igb_io_resume() calls igb_up() on a device that is already up, triggering a kernel BUG at net/core/dev.c:6539 (napi_enable). This results in a kernel panic. The fix introduces a check in igb_io_resume() to verify if the device is actually down before attempting to bring it up.
Affected products
- Linux Linux Kernel 4.14.322 to 4.15, 4.19.291 to 4.20, 5.4.251 to 5.5, and other stable branches prior to fix
Timeline
- 2024-10-21: advisory: Initial publication of CVE-2024-50040
- 2024-10-17: patched: Fix committed to various Linux stable branches
References
- https://git.kernel.org/stable/c/0a94079e3841d00ea5abb05e3233d019a86745f6
- https://git.kernel.org/stable/c/330a699ecbfc9c26ec92c6310686da1230b4e7eb
- https://git.kernel.org/stable/c/500be93c5d53b7e2c5314292012185f0207bad0c
- https://git.kernel.org/stable/c/57c5053eaa5f9a8a99e34732e37a86615318e464
- https://git.kernel.org/stable/c/6a39c8f5c8aae74c5ab2ba466791f59ffaab0178
- https://git.kernel.org/stable/c/c92cbd283ddcf55fd85a9a9b0ba13298213f3dd7
- https://git.kernel.org/stable/c/d79af3af2f49c6aae9add3d492c04d60c1b85ce4