CVE-2024-41047

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

i40e: Fix XDP program unloading while removing the driver

The commit 6533e558c650 ("i40e: Fix reset path while removing

the driver") introduced a new PF state "__I40E_IN_REMOVE" to block

modifying the XDP program while the driver is being removed.

Unfortunately, such a change is useful only if the ".ndo_bpf()"

callback was called out of the rmmod context because unloading the

existing XDP program is also a part of driver removing procedure.

In other words, from the rmmod context the driver is expected to

unload the XDP program without reporting any errors. Otherwise,

the kernel warning with callstack is printed out to dmesg.

Example failing scenario:

1. Load the i40e driver.

2. Load the XDP program.

3. Unload the i40e driver (using "rmmod" command).

The example kernel warning log:

[ +0.004646] WARNING: CPU: 94 PID: 10395 at net/core/dev.c:9290 unregister_netdevice_many_notify+0x7a9/0x870

[...]

[ +0.010959] RI

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References