CVE-2024-36020: i40e: fix vf may be used uninitialized in this function warning
In the Linux kernel, the following vulnerability has been resolved:
i40e: fix vf may be used uninitialized in this function warning
The Linux kernel CVE team has assigned CVE-2024-36020 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024053044-CVE-2024-36020-5da7@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
i40e: fix vf may be used uninitialized in this function warning
To fix the regression introduced by commit 52424f974bc5, which causes servers hang in very hard to reproduce conditions with resets races. Using two sources for the information is the root cause. In this function before the fix bumping v didn't mean bumping vf pointer. But the code used this variables interchangeably, so stale vf could point to different/not intended vf.
Remove redundant "v" variable and iterate via single VF pointer across whole function instead to guarantee VF pointer validity.
— NVD
Linux Kernel is vulnerable to a denial of service, caused by a race condition in the Ethernet Controller XL710 family driver. A remote authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36020?
The severity of CVE-2024-36020 is classified as low due to the nature of the vulnerability.
How do I fix CVE-2024-36020?
To fix CVE-2024-36020, update to the latest kernel version specified in the advisory or apply available patches.
Which versions of the Linux kernel are affected by CVE-2024-36020?
CVE-2024-36020 affects several versions of the Linux kernel including 4.19.312, 5.4.274, and others up to 6.9.
What is the impact of CVE-2024-36020 on system security?
The impact of CVE-2024-36020 on system security primarily involves potential uninitialized variable usage which could lead to unexpected behavior.
What operating systems are impacted by CVE-2024-36020?
CVE-2024-36020 impacts various Linux distributions utilizing the affected kernel versions such as Red Hat and Debian.