CVE-2024-46766

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ice: move netif_queue_set_napi to rtnl-protected sections

Currently, netif_queue_set_napi() is called from ice_vsi_rebuild() that is

not rtnl-locked when called from the reset. This creates the need to take

the rtnl_lock just for a single function and complicates the

synchronization with .ndo_bpf. At the same time, there no actual need to

fill napi-to-queue information at this exact point.

Fill napi-to-queue information when opening the VSI and clear it when the

VSI is being closed. Those routines are already rtnl-locked.

Also, rewrite napi-to-queue assignment in a way that prevents inclusion of

XDP queues, as this leads to out-of-bounds writes, such as one below.

[ +0.000004] BUG: KASAN: slab-out-of-bounds in netif_queue_set_napi+0x1c2/0x1e0

[ +0.000012] Write of size 8 at addr ffff889881727c80 by task bash/7047

[ +0.000006] CPU: 24 PID: 7047 Comm: bash Not tainted 6.10.0-rc2+ #2

[ +0.000004] Hardware name: I

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References