Linux Kernel up to 6.10.4 net/core/page_pool.c c:page_pool_disable_direct_recycling allocation of resources

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 6.10.4. This impacts the function c:page_pool_disable_direct_recycling of the file net/core/page_pool.c. The manipulation leads to allocation of resources. This vulnerability is documented as CVE-2024-44932. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.10.4 and classified as problematic. This issue affects the function c:page_pool_disable_direct_recycling of the file net/core/page_pool.c. The manipulation with an unknown input leads to a allocation of resources vulnerability. Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: idpf: fix UAFs when destroying the queues The second tagged commit started sometimes (very rarely, but possible) throwing WARNs from net/core/page_pool.c:page_pool_disable_direct_recycling(). Turned out idpf frees interrupt vectors with embedded NAPIs *before* freeing the queues making page_pools' NAPI pointers lead to freed memory before these pools are destroyed by libeth. It's not clear whether there are other accesses to the freed vectors when destroying the queues, but anyway, we usually free queue/interrupt vectors only when the queues are destroyed and the NAPIs are guaranteed to not be referenced anywhere. Invert the allocation and freeing logic making queue/interrupt vectors be allocated first and freed last. Vectors don't require queues to be present, so this is safe. Additionally, this change allows to remove that useless queue->q_vector pointer cleanup, as vectors are still valid when freeing the queues (+ both are freed within one function, so it's not clear why nullify the pointers at all).

The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2024-44932 since 08/21/2024. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 213014 (SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:4315-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.10.5 eliminates this vulnerability. Applying the patch 3cde714b0e77/290f1c033281 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (213014). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.10.0
• 6.10.1
• 6.10.2
• 6.10.3
• 6.10.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion