CVE-2024-49998

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: improve shutdown sequence

Alexander Sverdlin presents 2 problems during shutdown with the

lan9303 driver. One is specific to lan9303 and the other just happens

to reproduce there.

The first problem is that lan9303 is unique among DSA drivers in that it

calls dev_get_drvdata() at "arbitrary runtime" (not probe, not shutdown,

not remove):

phy_state_machine()

-> ...

-> dsa_user_phy_read()

-> ds->ops->phy_read()

-> lan9303_phy_read()

-> chip->ops->phy_read()

-> lan9303_mdio_phy_read()

-> dev_get_drvdata()

But we never stop the phy_state_machine(), so it may continue to run

after dsa_switch_shutdown(). Our common pattern in all DSA drivers is

to set drvdata to NULL to suppress the remove() method that may come

afterwards. But in this case it will result in an NPD.

The second problem is that the way in which we set

dp->conduit->dsa_ptr = NULL; is

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References