Bug 2301475 (CVE-2024-42112)

Summary:	CVE-2024-42112 kernel: net: txgbe: free isb resources at the right time
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dfreiber, drow, jburrell, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.9.9, kernel 6.10	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in the Linux kernel in the txgbe.c driver where the shared interrupts are handled in the device remove routing, before free IRQs. This can cause isb memory to still be read after it is freed, leading to a use-after-free situation which can cause memory corruption or crashes.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2301774
Bug Blocks:

Description OSIDB Bzimport 2024-07-30 08:31:08 UTC

In the Linux kernel, the following vulnerability has been resolved:

net: txgbe: free isb resources at the right time

When using MSI/INTx interrupt, the shared interrupts are still being
handled in the device remove routine, before free IRQs. So isb memory
is still read after it is freed. Thus move wx_free_isb_resources()
from txgbe_close() to txgbe_remove(). And fix the improper isb free
action in txgbe_open() error handling path.

Comment 1 Mauro Matteo Cascella 2024-07-30 18:53:04 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024073022-CVE-2024-42112-ee07@gregkh/T

Comment 2 Mauro Matteo Cascella 2024-07-30 18:53:25 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2301774]