In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Discard command completions in internal error
Fix use after free when FW completion arrives while device is in
internal error state. Avoid calling completion handler in this case,
since the device will flush the command interface and trigger all
completions manually.
Kernel log:
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
...
RIP: 0010:refcount_warn_saturate+0xd8/0xe0
...
Call Trace:
<IRQ>
? __warn+0x79/0x120
? refcount_warn_saturate+0xd8/0xe0
? report_bug+0x17c/0x190
? handle_bug+0x3c/0x60
? exc_invalid_op+0x14/0x70
? asm_exc_invalid_op+0x16/0x20
? refcount_warn_saturate+0xd8/0xe0
cmd_ent_put+0x13b/0x160 [mlx5_core]
mlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core]
cmd_comp_notifier+0x1f/0x30 [mlx5_core]
notifier_call_chain+0x35/0xb0
atomic_notifier_call_chain+0x16/0x20
mlx5_eq_async_int+0xf6/0x290 [mlx5_core]
notifier_call_chain+0x35/0xb0
atomic_notifier_call_chain+0x16/0x20
irq_int_handler+0x19/0x30 [mlx5_core]
__handle_irq_event_percpu+0x4b/0x160
handle_irq_event+0x2e/0x80
handle_edge_irq+0x98/0x230
__common_interrupt+0x3b/0xa0
common_interrupt+0x7b/0xa0
</IRQ>
<TASK>
asm_common_interrupt+0x22/0x40
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 09:26
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb - Patch | |
| References | () https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7 - Patch | |
| References | () https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0 - Patch | |
| References | () https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a - Patch | |
| References | () https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396 - Patch | |
| References | () https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40 - Patch | |
| References | () https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3 - Patch |
27 Aug 2024, 19:54
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux
Linux linux Kernel |
|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| References | () https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb - Patch | |
| References | () https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7 - Patch | |
| References | () https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0 - Patch | |
| References | () https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a - Patch | |
| References | () https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396 - Patch | |
| References | () https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40 - Patch | |
| References | () https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3 - Patch | |
| CWE | CWE-416 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
20 Jun 2024, 12:44
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
19 Jun 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-19 14:15
Updated : 2024-11-21 09:26
NVD link : CVE-2024-38555
Mitre link : CVE-2024-38555
CVE.ORG link : CVE-2024-38555
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free