CVE-2024-44932

idpf: fix UAFs when destroying the queues

published August 26, 2024

CVSS
—
EPSS
0%
Percentile
12.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix UAFs when destroying the queues

The second tagged commit started sometimes (very rarely, but possible)

throwing WARNs from

net/core/page_pool.c:page_pool_disable_direct_recycling().

Turned out idpf frees interrupt vectors with embedded NAPIs *before*

freeing the queues making page_pools' NAPI pointers lead to freed

memory before these pools are destroyed by libeth.

It's not clear whether there are other accesses to the freed vectors

when destroying the queues, but anyway, we usually free queue/interrupt

vectors only when the queues are destroyed and the NAPIs are guaranteed

to not be referenced anywhere.

Invert the allocation and freeing logic making queue/interrupt vectors

be allocated first and freed last. Vectors don't require queues to be

present, so this is safe. Additionally, this change allows to remove

that useless queue->q_vector pointer cleanup, as vectors are still

valid when freeing the queues (+ both are freed within one function,

so it's not clear why nullify the pointers at all).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00229 · 12.9th percentile
Published
2024-08-26T10:11Z
EPSS history
Timeline
  • 26 AUG 10:11Z
    idpf: fix UAFs when destroying the queues
    cvelistv5