CVE-2024-26587

2024-02-2217:15:08

CWE-476

416baaa9-dc9f-4396-8d5f-8c081fb06d67

web.nvd.nist.gov

linux kernel

netdevsim

vulnerability

phc

destroy

fixed

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

5.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

In the Linux kernel, the following vulnerability has been resolved:

net: netdevsim: don’t try to destroy PHC on VFs

PHC gets initialized in nsim_init_netdevsim(), which
is only called if (nsim_dev_port_is_pf()).

Create a counterpart of nsim_init_netdevsim() and
move the mock_phc_destroy() there.

This fixes a crash trying to destroy netdevsim with
VFs instantiated, as caught by running the devlink.sh test:

BUG: kernel NULL pointer dereference, address: 00000000000000b8
RIP: 0010:mock_phc_destroy+0xd/0x30
Call Trace:
 &lt;TASK&gt;
 nsim_destroy+0x4a/0x70 [netdevsim]
 __nsim_dev_port_del+0x47/0x70 [netdevsim]
 nsim_dev_reload_destroy+0x105/0x120 [netdevsim]
 nsim_drv_remove+0x2f/0xb0 [netdevsim]
 device_release_driver_internal+0x1a1/0x210
 bus_remove_device+0xd5/0x120
 device_del+0x159/0x490
 device_unregister+0x12/0x30
 del_device_store+0x11a/0x1a0 [netdevsim]
 kernfs_fop_write_iter+0x130/0x1d0
 vfs_write+0x30b/0x4b0
 ksys_write+0x69/0xf0
 do_syscall_64+0xcc/0x1e0
 entry_SYSCALL_64_after_hwframe+0x6f/0x77