CVE-2024-44964

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix memory leaks and crashes while performing a soft reset

The second tagged commit introduced a UAF, as it removed restoring

q_vector->vport pointers after reinitializating the structures.

This is due to that all queue allocation functions are performed here

with the new temporary vport structure and those functions rewrite

the backpointers to the vport. Then, this new struct is freed and

the pointers start leading to nowhere.

But generally speaking, the current logic is very fragile. It claims

to be more reliable when the system is low on memory, but in fact, it

consumes two times more memory as at the moment of running this

function, there are two vports allocated with their queues and vectors.

Moreover, it claims to prevent the driver from running into "bad state",

but in fact, any error during the rebuild leaves the old vport in the

partially allocated state.

Finally, if the interface is down when the fun

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References