CVE-2024-36002 in Linux
Summary
by MITRE • 05/20/2024
In the Linux kernel, the following vulnerability has been resolved:
dpll: fix dpll_pin_on_pin_register() for multiple parent pins
In scenario where pin is registered with multiple parent pins via dpll_pin_on_pin_register(..), all belonging to the same dpll device. A second call to dpll_pin_on_pin_unregister(..) would cause a call trace, as it tries to use already released registration resources (due to fix introduced in b446631f355e). In this scenario pin was registered twice, so resources are not yet expected to be release until each registered pin/pin pair is unregistered.
Currently, the following crash/call trace is produced when ice driver is removed on the system with installed E810T NIC which includes dpll device:
WARNING: CPU: 51 PID: 9155 at drivers/dpll/dpll_core.c:809 dpll_pin_ops+0x20/0x30 RIP: 0010:dpll_pin_ops+0x20/0x30 Call Trace: ? __warn+0x7f/0x130 ? dpll_pin_ops+0x20/0x30 dpll_msg_add_pin_freq+0x37/0x1d0 dpll_cmd_pin_get_one+0x1c0/0x400 ? __nlmsg_put+0x63/0x80 dpll_pin_event_send+0x93/0x140 dpll_pin_on_pin_unregister+0x3f/0x100 ice_dpll_deinit_pins+0xa1/0x230 [ice]
ice_remove+0xf1/0x210 [ice]
Fix by adding a parent pointer as a cookie when creating a registration, also when searching for it. For the regular pins pass NULL, this allows to create separated registration for each parent the pin is registered with.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/24/2025
The vulnerability CVE-2024-36002 affects the Linux kernel's Distributed Phase-Locked Loop (DPLL) subsystem, specifically within the dpll_core.c module. This issue manifests when a pin is registered with multiple parent pins belonging to the same DPLL device through the dpll_pin_on_pin_register() function. The problem arises from improper resource management during the unregistration process, creating a scenario where subsequent calls to dpll_pin_on_pin_unregister() attempt to access already released registration resources. This vulnerability is particularly significant because it directly impacts the stability of network drivers that utilize DPLL functionality, specifically affecting Intel E810T NICs which incorporate DPLL devices in their architecture.
The technical flaw stems from a design oversight in how registration resources are tracked and managed when multiple parent pins are associated with a single pin. When the dpll_pin_on_pin_register() function is called multiple times for the same pin with different parent pins, the system should maintain separate registration entries for each parent-child relationship. However, the existing implementation fails to properly distinguish between these distinct registrations, causing resource conflicts during cleanup operations. The kernel's DPLL subsystem operates under the principle that each pin-parent relationship requires independent resource management, but the current implementation does not adequately support this requirement. This issue is classified as a resource management problem and aligns with CWE-415: Double Free and CWE-416: Use After Free, as the system attempts to access memory that has already been freed during the unregistration process.
The operational impact of this vulnerability is severe, particularly in network infrastructure environments where precise timing synchronization is critical. When the ice driver is removed from a system containing E810T NICs, the kernel experiences a critical call trace that results in system instability or potential crashes. The call trace demonstrates a clear path from the dpll_pin_ops function through various DPLL subsystem components including dpll_msg_add_pin_freq, dpll_cmd_pin_get_one, and ultimately to ice_dpll_deinit_pins before reaching the fatal ice_remove function. This sequence indicates that the driver removal process triggers the memory access violation when attempting to clean up DPLL resources. The vulnerability essentially creates a race condition in the DPLL subsystem's resource management, where the system cannot properly differentiate between multiple registrations of the same pin with different parents, leading to memory corruption and system instability. This issue directly impacts the ATT&CK technique T1489: Service Stop, as it causes system-level service interruptions during driver removal operations.
The fix implemented addresses this vulnerability by introducing a parent pointer as a cookie during the registration process, ensuring that each pin-parent relationship maintains its own distinct registration context. This approach allows the system to properly track multiple registrations for the same pin with different parents, preventing the premature release of resources that was causing the crash. For regular pins, the implementation passes NULL as the cookie, maintaining backward compatibility while creating separate registration entries for each parent. This solution follows established kernel development practices for resource management and aligns with the kernel's design principles for handling complex subsystem interactions. The fix essentially implements a proper reference counting mechanism that tracks each distinct pin-parent relationship independently, preventing the double-free scenario that was causing the system to crash during driver removal operations. This mitigation approach ensures that resources are only released when all corresponding registrations have been properly unregistered, maintaining system stability and preventing potential denial-of-service conditions in network environments relying on precise timing synchronization.