|
Vulnerabilities
< Back

CVE-2024-40906

Updated on 12 Jul 2024

Severity

7.8 High severity

Details

CVSS score
7.8
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Always stop health timer during driver removal

Currently, if teardown_hca fails to execute during driver removal, mlx5 does not stop the health timer. Afterwards, mlx5 continue with driver teardown. This may lead to a UAF bug, which results in page fault Oops[1], since the health timer invokes after resources were freed.

Hence, stop the health monitor even if teardown_hca fails.

[1] mlx5_core 0000:18:00.0: E-Switch: Unload vfs: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:18:00.0: E-Switch: cleanup mlx5_core 0000:18:00.0: wait_func:1155:(pid 1967079): TEARDOWN_HCA(0x103) timeout. Will cause a leak of a command resource mlx5_core 0000:18:00.0: mlx5_function_close:1288:(pid 1967079): tear_down_hca failed, skip cleanup BUG: unable to handle page fault for address: ffffa26487064230 PGD 100c00067 P4D 100c00067 PUD 100e5a067 PMD 105ed7067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 0 Comm: swapper/0 Tainted: G OE ——- — 6.7.0-68.fc38.x86_64 #1 Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0013.121520200651 12/15/2020 RIP: 0010:ioread32be+0x34/0x60 RSP: 0018:ffffa26480003e58 EFLAGS: 00010292 RAX: ffffa26487064200 RBX: ffff9042d08161a0 RCX: ffff904c108222c0 RDX: 000000010bbf1b80 RSI: ffffffffc055ddb0 RDI: ffffa26487064230 RBP: ffff9042d08161a0 R08: 0000000000000022 R09: ffff904c108222e8 R10: 0000000000000004 R11: 0000000000000441 R12: ffffffffc055ddb0 R13: ffffa26487064200 R14: ffffa26480003f00 R15: ffff904c108222c0 FS: 0000000000000000(0000) GS:ffff904c10800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffa26487064230 CR3: 00000002c4420006 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? exc_page_fault+0x175/0x180 ? asm_exc_page_fault+0x26/0x30 ? __pfx_poll_health+0x10/0x10 [mlx5_core] ? __pfx_poll_health+0x10/0x10 [mlx5_core] ? ioread32be+0x34/0x60 mlx5_health_check_fatal_sensors+0x20/0x100 [mlx5_core] ? __pfx_poll_health+0x10/0x10 [mlx5_core] poll_health+0x42/0x230 [mlx5_core] ? __next_timer_interrupt+0xbc/0x110 ? __pfx_poll_health+0x10/0x10 [mlx5_core] call_timer_fn+0x21/0x130 ? __pfx_poll_health+0x10/0x10 [mlx5_core] __run_timers+0x222/0x2c0 run_timer_softirq+0x1d/0x40 __do_softirq+0xc9/0x2c8 __irq_exit_rcu+0xa6/0xc0 sysvec_apic_timer_interrupt+0x72/0x90 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:cpuidle_enter_state+0xcc/0x440 ? cpuidle_enter_state+0xbd/0x440 cpuidle_enter+0x2d/0x40 do_idle+0x20d/0x270 cpu_startup_entry+0x2a/0x30 rest_init+0xd0/0xd0 arch_call_rest_init+0xe/0x30 start_kernel+0x709/0xa90 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0x96/0xa0 secondary_startup_64_no_verify+0x18f/0x19b —[ end trace 0000000000000000 ]—

Details

Affected product:
AlmaLinux 9.2 ESU , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , TuxCare 9.6 ESU
Affected packages:
kernel @ 4.18.0 (+5 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
AlmaLinux 8 Released
27 kernels
  • 4.18.0-513.5.1.el8_9
  • 4.18.0-513.9.1.el8_9
  • 4.18.0-513.11.1.el8_9
  • 4.18.0-513.18.1.el8_9
  • 4.18.0-513.24.1.el8_9
  • 4.18.0-513.18.2.el8_9
  • 4.18.0-553.el8_10
  • 4.18.0-553.5.1.el8_10
  • 4.18.0-553.8.1.el8_10
  • 4.18.0-553.16.1.el8_10
  • 4.18.0-553.22.1.el8_10
  • 4.18.0-553.27.1.el8_10
  • 4.18.0-553.30.1.el8_10
  • 4.18.0-553.32.1.el8_10
  • 4.18.0-553.34.1.el8_10
  • 4.18.0-553.33.1.el8_10
  • 4.18.0-553.37.1.el8_10
  • 4.18.0-553.40.1.el8_10
  • 4.18.0-553.36.1.el8_10
  • 4.18.0-553.44.1.el8_10
  • 4.18.0-553.45.1.el8_10
  • 4.18.0-553.46.1.el8_10
  • 4.18.0-553.42.1.el8_10
  • 4.18.0-553.50.1.el8_10
  • 4.18.0-553.47.1.el8_10
  • 4.18.0-553.52.1.el8_10
  • 4.18.0-553.51.1.el8_10
AlmaLinux 9 Released
19 kernels
  • 5.14.0-427.40.1.el9_4
  • 5.14.0-427.42.1.el9_4
  • 5.14.0-362.13.1.el9_3
  • 5.14.0-362.18.1.el9_3
  • 5.14.0-362.24.1.el9_3
  • 5.14.0-362.24.2.el9_3
  • 5.14.0-362.8.1.el9_3
  • 5.14.0-427.13.1.el9_4
  • 5.14.0-427.16.1.el9_4
  • 5.14.0-427.18.1.el9_4
  • 5.14.0-427.20.1.el9_4
  • 5.14.0-427.22.1.el9_4
  • 5.14.0-427.24.1.el9_4
  • 5.14.0-427.26.1.el9_4
  • 5.14.0-427.28.1.el9_4
  • 5.14.0-427.31.1.el9_4
  • 5.14.0-427.33.1.el9_4
  • 5.14.0-427.35.1.el9_4
  • 5.14.0-427.37.1.el9_4
CloudLinux OS 7h Released
35 kernels
  • 4.18.0-513.5.1.lve.el7h
  • 4.18.0-513.9.1.lve.el7h
  • 4.18.0-513.11.1.lve.el7h
  • 4.18.0-513.18.1.lve.el7h
  • 4.18.0-513.11.1.lve.1.el7h
  • 4.18.0-513.18.1.lve.2.el7h
  • 4.18.0-513.18.1.lve.1.el7h
  • 4.18.0-513.24.1.lve.el7h
  • 4.18.0-553.lve.el7h
  • 4.18.0-513.24.1.lve.1.el7h
  • 4.18.0-513.24.1.lve.2.el7h
  • 4.18.0-553.5.1.lve.el7h
  • 4.18.0-553.8.1.lve.el7h
  • 4.18.0-553.5.1.lve.1.el7h
  • 4.18.0-553.16.1.lve.el7h
  • 4.18.0-553.22.1.lve.el7h
  • 4.18.0-553.16.1.lve.1.el7h
  • 4.18.0-553.27.1.lve.el7h
  • 4.18.0-553.22.1.lve.1.el7h
  • 4.18.0-553.30.1.lve.el7h
  • 4.18.0-553.32.1.lve.el7h
  • 4.18.0-553.27.1.lve.1.el7h
  • 4.18.0-553.34.1.lve.el7h
  • 4.18.0-553.33.1.lve.el7h
  • 4.18.0-553.37.1.lve.el7h
  • 4.18.0-553.40.1.lve.el7h
  • 4.18.0-553.36.1.lve.el7h
  • 4.18.0-553.44.1.lve.el7h
  • 4.18.0-553.45.1.lve.el7h
  • 4.18.0-553.46.1.lve.el7h
  • 4.18.0-553.50.1.lve.el7h
  • 4.18.0-553.47.1.lve.el7h
  • 4.18.0-553.52.1.lve.el7h
  • 4.18.0-553.51.1.lve.1.el7h
  • 4.18.0-553.51.1.lve.el7h
CloudLinux OS 8 Released
35 kernels
  • 4.18.0-553.52.1.lve.el8
  • 4.18.0-513.5.1.lve.el8
  • 4.18.0-513.9.1.lve.el8
  • 4.18.0-513.11.1.lve.el8
  • 4.18.0-513.18.1.lve.el8
  • 4.18.0-513.18.1.lve.2.el8
  • 4.18.0-513.18.1.lve.1.el8
  • 4.18.0-513.24.1.lve.el8
  • 4.18.0-513.24.1.lve.1.el8
  • 4.18.0-553.lve.el8
  • 4.18.0-513.24.1.lve.2.el8
  • 4.18.0-553.5.1.lve.el8
  • 4.18.0-544.lve.el8
  • 4.18.0-553.5.1.lve.1.el8
  • 4.18.0-553.8.1.lve.el8
  • 4.18.0-553.16.1.lve.el8
  • 4.18.0-553.16.1.lve.1.el8
  • 4.18.0-553.22.1.lve.el8
  • 4.18.0-553.22.1.lve.1.el8
  • 4.18.0-553.27.1.lve.el8
  • 4.18.0-553.30.1.lve.el8
  • 4.18.0-553.27.1.lve.1.el8
  • 4.18.0-553.32.1.lve.el8
  • 4.18.0-553.34.1.lve.el8
  • 4.18.0-553.33.1.lve.el8
  • 4.18.0-553.37.1.lve.el8
  • 4.18.0-553.40.1.lve.el8
  • 4.18.0-553.44.1.lve.el8
  • 4.18.0-553.36.1.lve.el8
  • 4.18.0-553.45.1.lve.el8
  • 4.18.0-553.46.1.lve.el8
  • 4.18.0-553.50.1.lve.el8
  • 4.18.0-553.47.1.lve.el8
  • 4.18.0-553.51.1.lve.el8
  • 4.18.0-553.51.1.lve.1.el8
Debian 12 Planned —
Oracle Linux 8 Released
29 kernels
  • 4.18.0-513.5.1.el8_9
  • 4.18.0-513.9.1.el8_9
  • 4.18.0-513.11.0.1.el8_9
  • 4.18.0-513.18.0.1.el8_9
  • 4.18.0-513.18.0.2.el8_9
  • 4.18.0-513.18.1.el8_9
  • 4.18.0-513.18.1.0.1.el8_9
  • 4.18.0-513.24.1.el8_9
  • 4.18.0-553.el8_10
  • 4.18.0-553.5.1.el8_10
  • 4.18.0-553.8.1.el8_10
  • 4.18.0-553.16.1.el8_10
  • 4.18.0-553.22.1.el8_10
  • 4.18.0-553.27.1.el8_10
  • 4.18.0-553.30.1.el8_10
  • 4.18.0-553.32.1.el8_10
  • 4.18.0-553.33.1.el8_10
  • 4.18.0-553.34.1.el8_10
  • 4.18.0-553.36.1.el8_10
  • 4.18.0-553.37.1.el8_10
  • 4.18.0-553.40.1.el8_10
  • 4.18.0-553.44.1.el8_10
  • 4.18.0-553.45.1.el8_10
  • 4.18.0-553.42.1.el8_10
  • 4.18.0-553.46.1.el8_10
  • 4.18.0-553.47.1.el8_10
  • 4.18.0-553.50.1.el8_10
  • 4.18.0-553.51.1.el8_10
  • 4.18.0-553.52.1.el8_10
Oracle Linux 8 UEK 7 Released
13 kernels
  • 5.15.0-300.163.18.el8uek
  • 5.15.0-300.163.18.1.el8uek
  • 5.15.0-300.163.18.1.1.el8uek
  • 5.15.0-301.163.5.2.el8uek
  • 5.15.0-302.167.6.el8uek
  • 5.15.0-300.163.18.7.el8uek
  • 5.15.0-302.167.6.1.el8uek
  • 5.15.0-303.171.5.2.el8uek
  • 5.15.0-303.171.5.2.1.el8uek
  • 5.15.0-304.171.4.el8uek
  • 5.15.0-304.171.4.1.el8uek
  • 5.15.0-304.171.4.3.el8uek
  • 5.15.0-303.171.5.2.2.el8uek
Oracle Linux 9 Released
23 kernels
  • 5.14.0-362.13.0.1.el9_3
  • 5.14.0-362.13.1.el9_3
  • 5.14.0-362.18.0.1.el9_3
  • 5.14.0-362.18.0.2.el9_3
  • 5.14.0-362.18.1.el9_3
  • 5.14.0-362.24.1.0.1.el9_3
  • 5.14.0-362.24.1.0.2.el9_3
  • 5.14.0-362.24.1.el9_3
  • 5.14.0-362.8.1.el9_3
  • 5.14.0-427.13.1.el9_4
  • 5.14.0-427.16.1.el9_4
  • 5.14.0-427.18.1.el9_4
  • 5.14.0-427.20.1.el9_4
  • 5.14.0-427.22.1.el9_4
  • 5.14.0-427.24.1.el9_4
  • 5.14.0-427.26.1.el9_4
  • 5.14.0-427.28.1.el9_4
  • 5.14.0-427.31.1.el9_4
  • 5.14.0-427.33.1.el9_4
  • 5.14.0-427.35.1.el9_4
  • 5.14.0-427.37.1.el9_4
  • 5.14.0-427.40.1.el9_4
  • 5.14.0-427.42.1.el9_4
Oracle Linux 9 UEK 7 Released
13 kernels
  • 5.15.0-300.163.18.el9uek
  • 5.15.0-300.163.18.1.el9uek
  • 5.15.0-300.163.18.1.1.el9uek
  • 5.15.0-301.163.5.2.el9uek
  • 5.15.0-302.167.6.el9uek
  • 5.15.0-300.163.18.7.el9uek
  • 5.15.0-302.167.6.1.el9uek
  • 5.15.0-303.171.5.2.el9uek
  • 5.15.0-303.171.5.2.1.el9uek
  • 5.15.0-304.171.4.el9uek
  • 5.15.0-304.171.4.1.el9uek
  • 5.15.0-304.171.4.3.el9uek
  • 5.15.0-303.171.5.2.2.el9uek
RHEL 8 Released
26 kernels
  • 4.18.0-513.5.1.el8_9
  • 4.18.0-513.9.1.el8_9
  • 4.18.0-513.11.1.el8_9
  • 4.18.0-513.18.1.el8_9
  • 4.18.0-513.24.1.el8_9
  • 4.18.0-553.el8_10
  • 4.18.0-553.5.1.el8_10
  • 4.18.0-553.8.1.el8_10
  • 4.18.0-553.16.1.el8_10
  • 4.18.0-553.22.1.el8_10
  • 4.18.0-553.27.1.el8_10
  • 4.18.0-553.30.1.el8_10
  • 4.18.0-553.32.1.el8_10
  • 4.18.0-553.33.1.el8_10
  • 4.18.0-553.34.1.el8_10
  • 4.18.0-553.36.1.el8_10
  • 4.18.0-553.37.1.el8_10
  • 4.18.0-553.40.1.el8_10
  • 4.18.0-553.42.1.el8_10
  • 4.18.0-553.44.1.el8_10
  • 4.18.0-553.45.1.el8_10
  • 4.18.0-553.46.1.el8_10
  • 4.18.0-553.47.1.el8_10
  • 4.18.0-553.50.1.el8_10
  • 4.18.0-553.51.1.el8_10
  • 4.18.0-553.52.1.el8_10
RHEL 9 Released
18 kernels
  • 5.14.0-362.13.1.el9_3
  • 5.14.0-362.18.1.el9_3
  • 5.14.0-362.24.1.el9_3
  • 5.14.0-362.8.1.el9_3
  • 5.14.0-427.13.1.el9_4
  • 5.14.0-427.16.1.el9_4
  • 5.14.0-427.18.1.el9_4
  • 5.14.0-427.20.1.el9_4
  • 5.14.0-427.22.1.el9_4
  • 5.14.0-427.24.1.el9_4
  • 5.14.0-427.26.1.el9_4
  • 5.14.0-427.28.1.el9_4
  • 5.14.0-427.31.1.el9_4
  • 5.14.0-427.33.1.el9_4
  • 5.14.0-427.35.1.el9_4
  • 5.14.0-427.37.1.el9_4
  • 5.14.0-427.40.1.el9_4
  • 5.14.0-427.42.1.el9_4
Rocky Linux 8 Released
26 kernels
  • 4.18.0-513.5.1.el8_9
  • 4.18.0-513.9.1.el8_9
  • 4.18.0-513.11.1.el8_9
  • 4.18.0-513.18.1.el8_9
  • 4.18.0-513.11.1.el8_9.0.1
  • 4.18.0-513.24.1.el8_9
  • 4.18.0-553.el8_10
  • 4.18.0-553.5.1.el8_10
  • 4.18.0-553.8.1.el8_10
  • 4.18.0-553.16.1.el8_10
  • 4.18.0-553.22.1.el8_10
  • 4.18.0-553.27.1.el8_10
  • 4.18.0-553.30.1.el8_10
  • 4.18.0-553.32.1.el8_10
  • 4.18.0-553.34.1.el8_10
  • 4.18.0-553.33.1.el8_10
  • 4.18.0-553.37.1.el8_10
  • 4.18.0-553.40.1.el8_10
  • 4.18.0-553.36.1.el8_10
  • 4.18.0-553.44.1.el8_10
  • 4.18.0-553.45.1.el8_10
  • 4.18.0-553.46.1.el8_10
  • 4.18.0-553.42.1.el8_10
  • 4.18.0-553.50.1.el8_10
  • 4.18.0-553.47.1.el8_10
  • 4.18.0-553.51.1.el8_10
Rocky Linux 9 Released
21 kernels
  • 5.14.0-362.13.1.el9_3
  • 5.14.0-362.18.1.el9_3.0.1
  • 5.14.0-362.18.1.el9_3
  • 5.14.0-362.24.1.el9_3.0.1
  • 5.14.0-362.24.1.el9_3
  • 5.14.0-362.8.1.el9_3
  • 5.14.0-427.16.1.el9_4
  • 5.14.0-427.18.1.el9_4
  • 5.14.0-427.20.1.el9_4.0.1
  • 5.14.0-427.20.1.el9_4
  • 5.14.0-427.22.1.el9_4
  • 5.14.0-427.24.1.el9_4
  • 5.14.0-427.26.1.el9_4
  • 5.14.0-427.28.1.el9_4
  • 5.14.0-427.31.1.el9_4
  • 5.14.0-427.33.1.el9_4
  • 5.14.0-427.35.1.el9_4
  • 5.14.0-427.37.1.el9_4
  • 5.14.0-427.40.1.el9_4
  • 5.14.0-427.42.1.el9_4
  • 5.14.0-427.13.1.el9_4
Ubuntu 24.04 Released
7 kernels
  • 6.8.0-31.31
  • 6.8.0-35.35
  • 6.8.0-36.36
  • 6.8.0-38.38
  • 6.8.0-39.39
  • 6.8.0-40.40
  • 6.8.0-41.41