cve-2024-50020
Vulnerability from cvelistv5
Published
2024-10-21 19:39
Modified
2024-12-19 09:31
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ice: Fix improper handling of refcount in ice_sriov_set_msix_vec_count() This patch addresses an issue with improper reference count handling in the ice_sriov_set_msix_vec_count() function. First, the function calls ice_get_vf_by_id(), which increments the reference count of the vf pointer. If the subsequent call to ice_get_vf_vsi() fails, the function currently returns an error without decrementing the reference count of the vf pointer, leading to a reference count leak. The correct behavior, as implemented in this patch, is to decrement the reference count using ice_put_vf(vf) before returning an error when vsi is NULL. Second, the function calls ice_sriov_get_irqs(), which sets vf->first_vector_idx. If this call returns a negative value, indicating an error, the function returns an error without decrementing the reference count of the vf pointer, resulting in another reference count leak. The patch addresses this by adding a call to ice_put_vf(vf) before returning an error when vf->first_vector_idx < 0. This bug was identified by an experimental static analysis tool developed by our team. The tool specializes in analyzing reference count operations and identifying potential mismanagement of reference counts. In this case, the tool flagged the missing decrement operation as a potential issue, leading to this patch.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/416dbb815ca69684de148328990ba0ec53e6dbc1Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d517cf89874c6039e6294b18d66f40988e62502aPatch
Impacted products
Vendor Product Version
Linux Linux Version: 4d38cb44bd321c81da3457cfbc38501ed8cb6714
Version: 4d38cb44bd321c81da3457cfbc38501ed8cb6714
 Create a notification for this product.
   Linux Linux Version: 6.7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-50020",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-22T13:27:30.418652Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-22T13:28:47.408Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "drivers/net/ethernet/intel/ice/ice_sriov.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "416dbb815ca69684de148328990ba0ec53e6dbc1",
                     status: "affected",
                     version: "4d38cb44bd321c81da3457cfbc38501ed8cb6714",
                     versionType: "git",
                  },
                  {
                     lessThan: "d517cf89874c6039e6294b18d66f40988e62502a",
                     status: "affected",
                     version: "4d38cb44bd321c81da3457cfbc38501ed8cb6714",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "drivers/net/ethernet/intel/ice/ice_sriov.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "6.7",
                  },
                  {
                     lessThan: "6.7",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.11.*",
                     status: "unaffected",
                     version: "6.11.4",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.12",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix improper handling of refcount in ice_sriov_set_msix_vec_count()\n\nThis patch addresses an issue with improper reference count handling in the\nice_sriov_set_msix_vec_count() function.\n\nFirst, the function calls ice_get_vf_by_id(), which increments the\nreference count of the vf pointer. If the subsequent call to\nice_get_vf_vsi() fails, the function currently returns an error without\ndecrementing the reference count of the vf pointer, leading to a reference\ncount leak. The correct behavior, as implemented in this patch, is to\ndecrement the reference count using ice_put_vf(vf) before returning an\nerror when vsi is NULL.\n\nSecond, the function calls ice_sriov_get_irqs(), which sets\nvf->first_vector_idx. If this call returns a negative value, indicating an\nerror, the function returns an error without decrementing the reference\ncount of the vf pointer, resulting in another reference count leak. The\npatch addresses this by adding a call to ice_put_vf(vf) before returning\nan error when vf->first_vector_idx < 0.\n\nThis bug was identified by an experimental static analysis tool developed\nby our team. The tool specializes in analyzing reference count operations\nand identifying potential mismanagement of reference counts. In this case,\nthe tool flagged the missing decrement operation as a potential issue,\nleading to this patch.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-12-19T09:31:29.905Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/416dbb815ca69684de148328990ba0ec53e6dbc1",
            },
            {
               url: "https://git.kernel.org/stable/c/d517cf89874c6039e6294b18d66f40988e62502a",
            },
         ],
         title: "ice: Fix improper handling of refcount in ice_sriov_set_msix_vec_count()",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2024-50020",
      datePublished: "2024-10-21T19:39:26.555Z",
      dateReserved: "2024-10-21T12:17:06.064Z",
      dateUpdated: "2024-12-19T09:31:29.905Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-50020\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T20:15:15.573\",\"lastModified\":\"2024-10-25T14:50:42.230\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: Fix improper handling of refcount in ice_sriov_set_msix_vec_count()\\n\\nThis patch addresses an issue with improper reference count handling in the\\nice_sriov_set_msix_vec_count() function.\\n\\nFirst, the function calls ice_get_vf_by_id(), which increments the\\nreference count of the vf pointer. If the subsequent call to\\nice_get_vf_vsi() fails, the function currently returns an error without\\ndecrementing the reference count of the vf pointer, leading to a reference\\ncount leak. The correct behavior, as implemented in this patch, is to\\ndecrement the reference count using ice_put_vf(vf) before returning an\\nerror when vsi is NULL.\\n\\nSecond, the function calls ice_sriov_get_irqs(), which sets\\nvf->first_vector_idx. If this call returns a negative value, indicating an\\nerror, the function returns an error without decrementing the reference\\ncount of the vf pointer, resulting in another reference count leak. The\\npatch addresses this by adding a call to ice_put_vf(vf) before returning\\nan error when vf->first_vector_idx < 0.\\n\\nThis bug was identified by an experimental static analysis tool developed\\nby our team. The tool specializes in analyzing reference count operations\\nand identifying potential mismanagement of reference counts. In this case,\\nthe tool flagged the missing decrement operation as a potential issue,\\nleading to this patch.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: Se corrige el manejo incorrecto de refcount en ice_sriov_set_msix_vec_count() Este parche soluciona un problema con el manejo incorrecto del recuento de referencias en la función ice_sriov_set_msix_vec_count(). Primero, la función llama a ice_get_vf_by_id(), que incrementa el recuento de referencias del puntero vf. Si la llamada posterior a ice_get_vf_vsi() fallo, la función actualmente devuelve un error sin disminuir el recuento de referencias del puntero vf, lo que lleva a una pérdida del recuento de referencias. El comportamiento correcto, como se implementó en este parche, es disminuir el recuento de referencias usando ice_put_vf(vf) antes de devolver un error cuando vsi es NULL. En segundo lugar, la función llama a ice_sriov_get_irqs(), que establece vf-&gt;first_vector_idx. Si esta llamada devuelve un valor negativo, lo que indica un error, la función devuelve un error sin disminuir el recuento de referencia del puntero vf, lo que genera otra pérdida de recuento de referencia. El parche soluciona este problema agregando una llamada a ice_put_vf(vf) antes de devolver un error cuando vf-&gt;first_vector_idx &lt; 0. Este error fue identificado por una herramienta de análisis estático experimental desarrollada por nuestro equipo. La herramienta se especializa en analizar operaciones de recuento de referencia e identificar posibles errores de administración de los recuentos de referencia. En este caso, la herramienta marcó la operación de disminución faltante como un problema potencial, lo que llevó a este parche.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7.10\",\"versionEndExcluding\":\"6.8\",\"matchCriteriaId\":\"15130BF0-E913-4EC3-B479-B8FA35896797\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.11.4\",\"matchCriteriaId\":\"C354E062-80AD-4947-809C-E798BC6AAA39\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/416dbb815ca69684de148328990ba0ec53e6dbc1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d517cf89874c6039e6294b18d66f40988e62502a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50020\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:27:30.418652Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:27:33.626Z\"}}], \"cna\": {\"title\": \"ice: Fix improper handling of refcount in ice_sriov_set_msix_vec_count()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4d38cb44bd32\", \"lessThan\": \"416dbb815ca6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4d38cb44bd32\", \"lessThan\": \"d517cf89874c\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/intel/ice/ice_sriov.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.11.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12-rc3\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/intel/ice/ice_sriov.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/416dbb815ca69684de148328990ba0ec53e6dbc1\"}, {\"url\": \"https://git.kernel.org/stable/c/d517cf89874c6039e6294b18d66f40988e62502a\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: Fix improper handling of refcount in ice_sriov_set_msix_vec_count()\\n\\nThis patch addresses an issue with improper reference count handling in the\\nice_sriov_set_msix_vec_count() function.\\n\\nFirst, the function calls ice_get_vf_by_id(), which increments the\\nreference count of the vf pointer. If the subsequent call to\\nice_get_vf_vsi() fails, the function currently returns an error without\\ndecrementing the reference count of the vf pointer, leading to a reference\\ncount leak. The correct behavior, as implemented in this patch, is to\\ndecrement the reference count using ice_put_vf(vf) before returning an\\nerror when vsi is NULL.\\n\\nSecond, the function calls ice_sriov_get_irqs(), which sets\\nvf->first_vector_idx. If this call returns a negative value, indicating an\\nerror, the function returns an error without decrementing the reference\\ncount of the vf pointer, resulting in another reference count leak. The\\npatch addresses this by adding a call to ice_put_vf(vf) before returning\\nan error when vf->first_vector_idx < 0.\\n\\nThis bug was identified by an experimental static analysis tool developed\\nby our team. The tool specializes in analyzing reference count operations\\nand identifying potential mismanagement of reference counts. In this case,\\nthe tool flagged the missing decrement operation as a potential issue,\\nleading to this patch.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-05T09:53:37.202Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-50020\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-05T09:53:37.202Z\", \"dateReserved\": \"2024-10-21T12:17:06.064Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T19:39:26.555Z\", \"assignerShortName\": \"Linux\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.