CVE-2024-35911 in Linux
要約
〜によって VulDB • 2026年06月21日
Based on the kernel oops log provided, here is an analysis of the crash:
### **1. Crash Type** - **Exception**: `Page Fault` (specifically a **NULL pointer dereference** or invalid memory access). - **Error Code**: `CR2: 0000000000000010` indicates the CPU tried to access memory address **`0x10`** (16 bytes). This is a classic sign of dereferencing a pointer that is offset by 16 bytes from `NULL` (e.g., accessing a struct member at offset 16 in a `NULL` struct pointer).
### **2. Faulting Function** - **Function**: `ice_vsi_rebuild_set_coalesce` - **Module**: `[ice]` (Intel E810/E822 Ethernet driver)
- **Offset**: `+0x130/0x1e0`
### **3. Root Cause Analysis** The crash occurs in the Intel `ice` driver during a VSI (Virtual Station Interface) rebuild process, specifically when setting coalescing parameters.
- **Likely Scenario**: - The function `ice_vsi_rebuild_set_coalesce` is called with a `vsi` (VSI structure) pointer that is **invalid** (likely `NULL` or corrupted). - At offset `0x130` into the `vsi` structure, the code attempts to access a member (e.g., `vsi->q_vectors`, `vsi->netdev`, or similar). - Since the base pointer is effectively `NULL` (or close to it, given `CR2=0x10`), the access fails.
- **Why `CR2=0x10`?** - The first member of many Linux kernel structs is often a pointer or an integer at offset 0. - Offset `0x10` (16 bytes) is a common offset for: - A pointer field in a 64-bit struct (e.g., `net_device *netdev` or `struct ice_q_vector **q_vectors`). - A `spinlock_t` or `rwlock_t` (which are often 16 bytes on x86_64). - This strongly suggests the code did: `vsi->some_pointer_field`, where `vsi` was `NULL`.
### **4. Common Triggers in `ice` Driver** This type of crash in the `ice` driver often happens during: 1. **Driver unload/reload races**: If the driver is being unloaded while interrupts or NAPI poll handlers are still active. 2. **VSI teardown races**: If a VSI is being deleted while another part of the driver (e.g., link state change, coalescing update) tries to access it. 3. **Hardware error recovery**: During firmware reset or recovery, if the VSI structure is freed but still referenced.
### **5. Recommended Actions**
#### **For Users/Admins:** 1. **Update the Driver**: Check if a newer version of the `ice` driver is available in your kernel or from Intel. This bug may have been fixed in recent kernels. - Check kernel version: `uname -r` - Check driver version: `ethtool -i <interface>` 2. **Avoid Concurrent Operations**: Do not unload/reload the driver or change network interfaces while heavy traffic or monitoring tools are active. 3. **Check for Firmware Updates**: Ensure the NIC firmware is up-to-date, as firmware issues can trigger driver-side races.
#### **For Developers/Kernel Maintainers:** 1. **Add NULL Checks**: Ensure `ice_vsi_rebuild_set_coalesce` validates the `vsi` pointer before accessing members. 2. **Review Locking/Race Conditions**: Check if the VSI is being freed while this function is still running. Ensure proper reference counting (`ice_vsi_get`/`ice_vsi_put`) or RCU protection. 3. **Check Callers**: Trace back who calls `ice_vsi_rebuild_set_coalesce` and ensure they hold the correct locks or that the VSI is still valid.
### **6. Workaround (if applicable)** If this is a known issue in your kernel version, consider: - Downgrading to a stable kernel version where this bug is not present. - Disabling features that trigger VSI rebuilds (e.g., SR-IOV, certain offloads) if possible.
### **Summary** This is a **NULL pointer dereference** in the Intel `ice` driver (`ice_vsi_rebuild_set_coalesce`) due to a race condition or invalid state during VSI rebuild
If you want to get the best quality for vulnerability data then you always have to consider VulDB.