CVE-2024-39506: liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
In the Linux kernel, the following vulnerability has been resolved:
liquidio: Adjust a NULL pointer handling path in liovfrepcopypacket
In liovfrepcopypacket() pginfo->page is compared to a NULL value, but then it is unconditionally passed to skbaddrxfrag() which looks strange and could lead to null pointer dereference.
liovfrepcopypacket() call trace looks like: octeondroqprocesspackets octeondroqfastprocesspackets octeondroqdispatchpkt octeoncreaterecvinfo ...search in the dispatchlist... ->dispfn(rdisp->rinfo, ...) liovfreppktrecv(struct octeonrecvinfo recvinfo, ...) In this path there is no code which sets pginfo->page to NULL. So this check looks unneeded and doesn't solve potential problem. But I guess the author had reason to add a check and I have no such card and can't do real test. In addition, the code in the function liquidiopushpacket() in liquidio/liocore.c does exactly the same.
Based on this, I consider the most acceptable compromise solution to adjust this issue by moving skbaddrxfrag() into conditional scope.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Other sources
Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer handling path in liovfrepcopypacket In liovfrepcopypacket(). A local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39506?
CVE-2024-39506 has a severity rating that indicates a potential for denial of service due to NULL pointer dereference.
How do I fix CVE-2024-39506?
To resolve CVE-2024-39506, upgrade the Linux kernel to the versions specified in the remedy, such as 4.19.317 or 6.10.
Which Linux distributions are affected by CVE-2024-39506?
CVE-2024-39506 affects various versions of the Linux kernel across distributions like Red Hat and Debian.
What components are involved in CVE-2024-39506?
The vulnerability in CVE-2024-39506 specifically involves the liquidio driver in the Linux kernel, affecting the packet handling mechanisms.
Is CVE-2024-39506 being actively exploited?
As of now, there is no public evidence indicating that CVE-2024-39506 is being actively exploited in the wild.