CVE-2024-35911 (GCVE-0-2024-35911)

Vulnerability from cvelistv5 – Published: 2024-05-19 08:35 – Updated: 2026-05-23 15:45
VLAI
Title
ice: fix memory corruption bug with suspend and rebuild
Summary
In the Linux kernel, the following vulnerability has been resolved: ice: fix memory corruption bug with suspend and rebuild The ice driver would previously panic after suspend. This is caused from the driver *only* calling the ice_vsi_free_q_vectors() function by itself, when it is suspending. Since commit b3e7b3a6ee92 ("ice: prevent NULL pointer deref during reload") the driver has zeroed out num_q_vectors, and only restored it in ice_vsi_cfg_def(). This further causes the ice_rebuild() function to allocate a zero length buffer, after which num_q_vectors is updated, and then the new value of num_q_vectors is used to index into the zero length buffer, which corrupts memory. The fix entails making sure all the code referencing num_q_vectors only does so after it has been reset via ice_vsi_cfg_def(). I didn't perform a full bisect, but I was able to test against 6.1.77 kernel and that ice driver works fine for suspend/resume with no panic, so sometime since then, this problem was introduced. Also clean up an un-needed init of a local variable in the function being modified. PANIC from 6.8.0-rc1: [1026674.915596] PM: suspend exit [1026675.664697] ice 0000:17:00.1: PTP reset successful [1026675.664707] ice 0000:17:00.1: 2755 msecs passed between update to cached PHC time [1026675.667660] ice 0000:b1:00.0: PTP reset successful [1026675.675944] ice 0000:b1:00.0: 2832 msecs passed between update to cached PHC time [1026677.137733] ixgbe 0000:31:00.0 ens787: NIC Link is Up 1 Gbps, Flow Control: None [1026677.190201] BUG: kernel NULL pointer dereference, address: 0000000000000010 [1026677.192753] ice 0000:17:00.0: PTP reset successful [1026677.192764] ice 0000:17:00.0: 4548 msecs passed between update to cached PHC time [1026677.197928] #PF: supervisor read access in kernel mode [1026677.197933] #PF: error_code(0x0000) - not-present page [1026677.197937] PGD 1557a7067 P4D 0 [1026677.212133] ice 0000:b1:00.1: PTP reset successful [1026677.212143] ice 0000:b1:00.1: 4344 msecs passed between update to cached PHC time [1026677.212575] [1026677.243142] Oops: 0000 [#1] PREEMPT SMP NOPTI [1026677.247918] CPU: 23 PID: 42790 Comm: kworker/23:0 Kdump: loaded Tainted: G W 6.8.0-rc1+ #1 [1026677.257989] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022 [1026677.269367] Workqueue: ice ice_service_task [ice] [1026677.274592] RIP: 0010:ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice] [1026677.281421] Code: 0f 84 3a ff ff ff 41 0f b7 74 ec 02 66 89 b0 22 02 00 00 81 e6 ff 1f 00 00 e8 ec fd ff ff e9 35 ff ff ff 48 8b 43 30 49 63 ed <41> 0f b7 34 24 41 83 c5 01 48 8b 3c e8 66 89 b7 aa 02 00 00 81 e6 [1026677.300877] RSP: 0018:ff3be62a6399bcc0 EFLAGS: 00010202 [1026677.306556] RAX: ff28691e28980828 RBX: ff28691e41099828 RCX: 0000000000188000 [1026677.314148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff28691e41099828 [1026677.321730] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [1026677.329311] R10: 0000000000000007 R11: ffffffffffffffc0 R12: 0000000000000010 [1026677.336896] R13: 0000000000000000 R14: 0000000000000000 R15: ff28691e0eaa81a0 [1026677.344472] FS: 0000000000000000(0000) GS:ff28693cbffc0000(0000) knlGS:0000000000000000 [1026677.353000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1026677.359195] CR2: 0000000000000010 CR3: 0000000128df4001 CR4: 0000000000771ef0 [1026677.366779] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1026677.374369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1026677.381952] PKRU: 55555554 [1026677.385116] Call Trace: [1026677.388023] <TASK> [1026677.390589] ? __die+0x20/0x70 [1026677.394105] ? page_fault_oops+0x82/0x160 [1026677.398576] ? do_user_addr_fault+0x65/0x6a0 [1026677.403307] ? exc_page_fault+0x6a/0x150 [1026677.407694] ? asm_exc_page_fault+0x22/0x30 [1026677.412349] ? ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice] [1026677.4186 ---truncated---
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b3e7b3a6ee92ab927f750a6b19615ce88ece808f , < e40a02f06ceb0e0b0183e0b973ac5dbf8f75edec (git)
Affected: b3e7b3a6ee92ab927f750a6b19615ce88ece808f , < 11ff8392943e08a35cb0aa19d638b02db745f170 (git)
Affected: b3e7b3a6ee92ab927f750a6b19615ce88ece808f , < 1cb7fdb1dfde1aab66780b4ba44dba6402172111 (git)
Affected: ca03b327224ed6be2d07f42ee6ee1cdd586cfd5b (git)
Affected: 6.4.7 , < 6.5 (semver)
Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.26 , ≤ 6.6.* (semver)
Unaffected: 6.8.5 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35911",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T17:12:50.504124Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:33:40.868Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:49.027Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e40a02f06ceb0e0b0183e0b973ac5dbf8f75edec"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/11ff8392943e08a35cb0aa19d638b02db745f170"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1cb7fdb1dfde1aab66780b4ba44dba6402172111"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e40a02f06ceb0e0b0183e0b973ac5dbf8f75edec",
              "status": "affected",
              "version": "b3e7b3a6ee92ab927f750a6b19615ce88ece808f",
              "versionType": "git"
            },
            {
              "lessThan": "11ff8392943e08a35cb0aa19d638b02db745f170",
              "status": "affected",
              "version": "b3e7b3a6ee92ab927f750a6b19615ce88ece808f",
              "versionType": "git"
            },
            {
              "lessThan": "1cb7fdb1dfde1aab66780b4ba44dba6402172111",
              "status": "affected",
              "version": "b3e7b3a6ee92ab927f750a6b19615ce88ece808f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ca03b327224ed6be2d07f42ee6ee1cdd586cfd5b",
              "versionType": "git"
            },
            {
              "lessThan": "6.5",
              "status": "affected",
              "version": "6.4.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.26",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix memory corruption bug with suspend and rebuild\n\nThe ice driver would previously panic after suspend. This is caused\nfrom the driver *only* calling the ice_vsi_free_q_vectors() function by\nitself, when it is suspending. Since commit b3e7b3a6ee92 (\"ice: prevent\nNULL pointer deref during reload\") the driver has zeroed out\nnum_q_vectors, and only restored it in ice_vsi_cfg_def().\n\nThis further causes the ice_rebuild() function to allocate a zero length\nbuffer, after which num_q_vectors is updated, and then the new value of\nnum_q_vectors is used to index into the zero length buffer, which\ncorrupts memory.\n\nThe fix entails making sure all the code referencing num_q_vectors only\ndoes so after it has been reset via ice_vsi_cfg_def().\n\nI didn\u0027t perform a full bisect, but I was able to test against 6.1.77\nkernel and that ice driver works fine for suspend/resume with no panic,\nso sometime since then, this problem was introduced.\n\nAlso clean up an un-needed init of a local variable in the function\nbeing modified.\n\nPANIC from 6.8.0-rc1:\n\n[1026674.915596] PM: suspend exit\n[1026675.664697] ice 0000:17:00.1: PTP reset successful\n[1026675.664707] ice 0000:17:00.1: 2755 msecs passed between update to cached PHC time\n[1026675.667660] ice 0000:b1:00.0: PTP reset successful\n[1026675.675944] ice 0000:b1:00.0: 2832 msecs passed between update to cached PHC time\n[1026677.137733] ixgbe 0000:31:00.0 ens787: NIC Link is Up 1 Gbps, Flow Control: None\n[1026677.190201] BUG: kernel NULL pointer dereference, address: 0000000000000010\n[1026677.192753] ice 0000:17:00.0: PTP reset successful\n[1026677.192764] ice 0000:17:00.0: 4548 msecs passed between update to cached PHC time\n[1026677.197928] #PF: supervisor read access in kernel mode\n[1026677.197933] #PF: error_code(0x0000) - not-present page\n[1026677.197937] PGD 1557a7067 P4D 0\n[1026677.212133] ice 0000:b1:00.1: PTP reset successful\n[1026677.212143] ice 0000:b1:00.1: 4344 msecs passed between update to cached PHC time\n[1026677.212575]\n[1026677.243142] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[1026677.247918] CPU: 23 PID: 42790 Comm: kworker/23:0 Kdump: loaded Tainted: G        W          6.8.0-rc1+ #1\n[1026677.257989] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022\n[1026677.269367] Workqueue: ice ice_service_task [ice]\n[1026677.274592] RIP: 0010:ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice]\n[1026677.281421] Code: 0f 84 3a ff ff ff 41 0f b7 74 ec 02 66 89 b0 22 02 00 00 81 e6 ff 1f 00 00 e8 ec fd ff ff e9 35 ff ff ff 48 8b 43 30 49 63 ed \u003c41\u003e 0f b7 34 24 41 83 c5 01 48 8b 3c e8 66 89 b7 aa 02 00 00 81 e6\n[1026677.300877] RSP: 0018:ff3be62a6399bcc0 EFLAGS: 00010202\n[1026677.306556] RAX: ff28691e28980828 RBX: ff28691e41099828 RCX: 0000000000188000\n[1026677.314148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff28691e41099828\n[1026677.321730] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n[1026677.329311] R10: 0000000000000007 R11: ffffffffffffffc0 R12: 0000000000000010\n[1026677.336896] R13: 0000000000000000 R14: 0000000000000000 R15: ff28691e0eaa81a0\n[1026677.344472] FS:  0000000000000000(0000) GS:ff28693cbffc0000(0000) knlGS:0000000000000000\n[1026677.353000] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[1026677.359195] CR2: 0000000000000010 CR3: 0000000128df4001 CR4: 0000000000771ef0\n[1026677.366779] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[1026677.374369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[1026677.381952] PKRU: 55555554\n[1026677.385116] Call Trace:\n[1026677.388023]  \u003cTASK\u003e\n[1026677.390589]  ? __die+0x20/0x70\n[1026677.394105]  ? page_fault_oops+0x82/0x160\n[1026677.398576]  ? do_user_addr_fault+0x65/0x6a0\n[1026677.403307]  ? exc_page_fault+0x6a/0x150\n[1026677.407694]  ? asm_exc_page_fault+0x22/0x30\n[1026677.412349]  ? ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice]\n[1026677.4186\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:45:13.380Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e40a02f06ceb0e0b0183e0b973ac5dbf8f75edec"
        },
        {
          "url": "https://git.kernel.org/stable/c/11ff8392943e08a35cb0aa19d638b02db745f170"
        },
        {
          "url": "https://git.kernel.org/stable/c/1cb7fdb1dfde1aab66780b4ba44dba6402172111"
        }
      ],
      "title": "ice: fix memory corruption bug with suspend and rebuild",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35911",
    "datePublished": "2024-05-19T08:35:04.299Z",
    "dateReserved": "2024-05-17T13:50:33.121Z",
    "dateUpdated": "2026-05-23T15:45:13.380Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35911",
      "date": "2026-06-19",
      "epss": "0.0022",
      "percentile": "0.12324"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35911\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-19T09:15:11.690\",\"lastModified\":\"2025-09-23T14:44:14.567\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: fix memory corruption bug with suspend and rebuild\\n\\nThe ice driver would previously panic after suspend. This is caused\\nfrom the driver *only* calling the ice_vsi_free_q_vectors() function by\\nitself, when it is suspending. Since commit b3e7b3a6ee92 (\\\"ice: prevent\\nNULL pointer deref during reload\\\") the driver has zeroed out\\nnum_q_vectors, and only restored it in ice_vsi_cfg_def().\\n\\nThis further causes the ice_rebuild() function to allocate a zero length\\nbuffer, after which num_q_vectors is updated, and then the new value of\\nnum_q_vectors is used to index into the zero length buffer, which\\ncorrupts memory.\\n\\nThe fix entails making sure all the code referencing num_q_vectors only\\ndoes so after it has been reset via ice_vsi_cfg_def().\\n\\nI didn\u0027t perform a full bisect, but I was able to test against 6.1.77\\nkernel and that ice driver works fine for suspend/resume with no panic,\\nso sometime since then, this problem was introduced.\\n\\nAlso clean up an un-needed init of a local variable in the function\\nbeing modified.\\n\\nPANIC from 6.8.0-rc1:\\n\\n[1026674.915596] PM: suspend exit\\n[1026675.664697] ice 0000:17:00.1: PTP reset successful\\n[1026675.664707] ice 0000:17:00.1: 2755 msecs passed between update to cached PHC time\\n[1026675.667660] ice 0000:b1:00.0: PTP reset successful\\n[1026675.675944] ice 0000:b1:00.0: 2832 msecs passed between update to cached PHC time\\n[1026677.137733] ixgbe 0000:31:00.0 ens787: NIC Link is Up 1 Gbps, Flow Control: None\\n[1026677.190201] BUG: kernel NULL pointer dereference, address: 0000000000000010\\n[1026677.192753] ice 0000:17:00.0: PTP reset successful\\n[1026677.192764] ice 0000:17:00.0: 4548 msecs passed between update to cached PHC time\\n[1026677.197928] #PF: supervisor read access in kernel mode\\n[1026677.197933] #PF: error_code(0x0000) - not-present page\\n[1026677.197937] PGD 1557a7067 P4D 0\\n[1026677.212133] ice 0000:b1:00.1: PTP reset successful\\n[1026677.212143] ice 0000:b1:00.1: 4344 msecs passed between update to cached PHC time\\n[1026677.212575]\\n[1026677.243142] Oops: 0000 [#1] PREEMPT SMP NOPTI\\n[1026677.247918] CPU: 23 PID: 42790 Comm: kworker/23:0 Kdump: loaded Tainted: G        W          6.8.0-rc1+ #1\\n[1026677.257989] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022\\n[1026677.269367] Workqueue: ice ice_service_task [ice]\\n[1026677.274592] RIP: 0010:ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice]\\n[1026677.281421] Code: 0f 84 3a ff ff ff 41 0f b7 74 ec 02 66 89 b0 22 02 00 00 81 e6 ff 1f 00 00 e8 ec fd ff ff e9 35 ff ff ff 48 8b 43 30 49 63 ed \u003c41\u003e 0f b7 34 24 41 83 c5 01 48 8b 3c e8 66 89 b7 aa 02 00 00 81 e6\\n[1026677.300877] RSP: 0018:ff3be62a6399bcc0 EFLAGS: 00010202\\n[1026677.306556] RAX: ff28691e28980828 RBX: ff28691e41099828 RCX: 0000000000188000\\n[1026677.314148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff28691e41099828\\n[1026677.321730] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\\n[1026677.329311] R10: 0000000000000007 R11: ffffffffffffffc0 R12: 0000000000000010\\n[1026677.336896] R13: 0000000000000000 R14: 0000000000000000 R15: ff28691e0eaa81a0\\n[1026677.344472] FS:  0000000000000000(0000) GS:ff28693cbffc0000(0000) knlGS:0000000000000000\\n[1026677.353000] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[1026677.359195] CR2: 0000000000000010 CR3: 0000000128df4001 CR4: 0000000000771ef0\\n[1026677.366779] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n[1026677.374369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n[1026677.381952] PKRU: 55555554\\n[1026677.385116] Call Trace:\\n[1026677.388023]  \u003cTASK\u003e\\n[1026677.390589]  ? __die+0x20/0x70\\n[1026677.394105]  ? page_fault_oops+0x82/0x160\\n[1026677.398576]  ? do_user_addr_fault+0x65/0x6a0\\n[1026677.403307]  ? exc_page_fault+0x6a/0x150\\n[1026677.407694]  ? asm_exc_page_fault+0x22/0x30\\n[1026677.412349]  ? ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice]\\n[1026677.4186\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: corrige el error de corrupci\u00f3n de memoria con suspensi\u00f3n y reconstrucci\u00f3n. Anteriormente, el controlador ice entraba en p\u00e1nico despu\u00e9s de la suspensi\u00f3n. Esto se debe a que el controlador *solo* llama a la funci\u00f3n ice_vsi_free_q_vectors() por s\u00ed mismo, cuando est\u00e1 suspendida. Desde la confirmaci\u00f3n b3e7b3a6ee92 (\\\"ice: evitar la eliminaci\u00f3n del puntero NULL durante la recarga\\\"), el controlador puso a cero num_q_vectors y solo lo restaur\u00f3 en ice_vsi_cfg_def(). Esto adem\u00e1s hace que la funci\u00f3n ice_rebuild() asigne un b\u00fafer de longitud cero, despu\u00e9s del cual se actualiza num_q_vectors, y luego el nuevo valor de num_q_vectors se usa para indexar en el b\u00fafer de longitud cero, lo que corrompe la memoria. La soluci\u00f3n implica asegurarse de que todo el c\u00f3digo que hace referencia a num_q_vectors solo lo haga despu\u00e9s de que se haya restablecido mediante ice_vsi_cfg_def(). No realic\u00e9 una bisecci\u00f3n completa, pero pude probar con el kernel 6.1.77 y ese controlador Ice funciona bien para suspender/reanudar sin p\u00e1nico, por lo que en alg\u00fan momento desde entonces, se introdujo este problema. Tambi\u00e9n limpie un inicio innecesario de una variable local en la funci\u00f3n que se est\u00e1 modificando. P\u00c1NICO desde 6.8.0-rc1: [1026674.915596] PM: suspender salida [1026675.664697] ice 0000:17:00.1: reinicio de PTP exitoso [1026675.664707] ice 0000:17:00.1: 2755 ms transcurridos entre la actualizaci\u00f3n y el tiempo de PHC en cach\u00e9 [102667 5.667660] ice 0000:b1:00.0: restablecimiento de PTP exitoso [1026675.675944] ice 0000:b1:00.0: 2832 ms transcurridos entre la actualizaci\u00f3n y el tiempo de PHC en cach\u00e9 [1026677.137733] ixgbe 0000:31:00.0 ens787: el enlace de NIC est\u00e1 activo 1 Gbps, control de flujo: Ninguno [1026677.190201] ERROR: desreferencia del puntero NULL del n\u00facleo, direcci\u00f3n: 0000000000000010 [1026677.192753] ice 0000:17:00.0: reinicio de PTP exitoso [1026677.192764] ice 0000:17:00.0: 4548 mseg. entre la actualizaci\u00f3n y el tiempo de PHC en cach\u00e9 [1026677.197928] # PF: acceso de lectura del supervisor en modo kernel [1026677.197933] #PF: error_code(0x0000) - p\u00e1gina no presente [1026677.197937] PGD 1557a7067 P4D 0 [1026677.212133] ice 0000:b1:00.1: reinicio de PTP exitoso [1026677.2 12143] hielo 0000:b1 :00.1: Pasaron 4344 ms entre la actualizaci\u00f3n y el tiempo de PHC en cach\u00e9 [1026677.212575] [1026677.243142] Vaya: 0000 [#1] PREEMPT SMP NOPTI [1026677.247918] CPU: 23 PID: 42790 Comm: kworker/23:0 Kdump: cargado Ta Inted: GW 6.8.0-rc1+ #1 [1026677.257989] Nombre de hardware: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 16/02/2022 [1026677.269367] Cola de trabajo: ice ice_service_tas k [hielo] [1026677.274592] RIP: 0010:ice_vsi_rebuild_set_coalesce +0x130/0x1e0 [ice] [1026677.281421] C\u00f3digo: 0f 84 3a ff ff ff 41 0f b7 74 ec 02 66 89 b0 22 02 00 00 81 e6 ff 1f 00 00 e8 ec fd ff ff e9 35 ff ff 4 8 8b 43 30 49 63 ed \u0026lt;41\u0026gt; 0f b7 34 24 41 83 c5 01 48 8b 3c e8 66 89 b7 aa 02 00 00 81 e6 [1026677.300877] RSP: 0018:ff3be62a6399bcc0 EFLAGS: 2 [1026677.306556] RAX: ff28691e28980828 RBX: ff28691e41099828 RCX: 0000000000188000 [1026677.314148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff28691e41099828 [1026677.321730] RBP: 0000000000 000000 R08: 0000000000000000 R09: 00000000000000000 [1026677.329311] R10: 0000000000000007 R11: ffffffffffffffc0 R12: 0000000000000010 [102 6677.336896] R13: 00000000000000000 R14: 0000000000000000 R15: ff28691e0eaa81a0 [ 1026677.344472] FS: 0000000000000000(0000) GS:ff28693cbffc0000(0000) knlGS:0000000000000000 [1026677.353000] CS: 0010 DS: 0000 ES: 0000 : 0000000080050033 [1026677.359195] CR2: 0000000000000010 CR3: 0000000128df4001 CR4: 0000000000771ef0 [1026677.366779] DR0: 00000000000 00000 DR1: 0000000000000000 DR2: 0000000000000000 [1026677.374369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1026677.3 81952] PKRU: 55555554 [1026677.385116] Seguimiento de llamadas: [1026677.388023]  [1026677.390589] ? __morir+0x20/0x70 [1026677.394105] --truncado--\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4.7\",\"versionEndExcluding\":\"6.5\",\"matchCriteriaId\":\"78D465F1-2AAE-44B0-94DE-389ED298943D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5.1\",\"versionEndExcluding\":\"6.6.26\",\"matchCriteriaId\":\"BA80EBD7-C813-4804-9178-BBE75C3D142B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.5\",\"matchCriteriaId\":\"DBD6C99E-4250-4DFE-8447-FF2075939D10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2D9420A-9BF4-4C16-B6DA-8A1D279F7384\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5608371-157A-4318-8A2E-4104C3467EA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"2226A776-DF8C-49E0-A030-0A7853BB018A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F15C659-DF06-455A-9765-0E6DE920F29A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"5B1C14ED-ABC4-41D3-8D9C-D38C6A65B4DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F187F8CD-249A-4AF1-877B-08E8C24A1A10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/11ff8392943e08a35cb0aa19d638b02db745f170\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1cb7fdb1dfde1aab66780b4ba44dba6402172111\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e40a02f06ceb0e0b0183e0b973ac5dbf8f75edec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/11ff8392943e08a35cb0aa19d638b02db745f170\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1cb7fdb1dfde1aab66780b4ba44dba6402172111\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e40a02f06ceb0e0b0183e0b973ac5dbf8f75edec\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e40a02f06ceb0e0b0183e0b973ac5dbf8f75edec\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/11ff8392943e08a35cb0aa19d638b02db745f170\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1cb7fdb1dfde1aab66780b4ba44dba6402172111\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:49.027Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35911\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-20T17:12:50.504124Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:25.047Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"ice: fix memory corruption bug with suspend and rebuild\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b3e7b3a6ee92ab927f750a6b19615ce88ece808f\", \"lessThan\": \"e40a02f06ceb0e0b0183e0b973ac5dbf8f75edec\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b3e7b3a6ee92ab927f750a6b19615ce88ece808f\", \"lessThan\": \"11ff8392943e08a35cb0aa19d638b02db745f170\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b3e7b3a6ee92ab927f750a6b19615ce88ece808f\", \"lessThan\": \"1cb7fdb1dfde1aab66780b4ba44dba6402172111\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ca03b327224ed6be2d07f42ee6ee1cdd586cfd5b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6.4.7\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/net/ethernet/intel/ice/ice_lib.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.26\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/intel/ice/ice_lib.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e40a02f06ceb0e0b0183e0b973ac5dbf8f75edec\"}, {\"url\": \"https://git.kernel.org/stable/c/11ff8392943e08a35cb0aa19d638b02db745f170\"}, {\"url\": \"https://git.kernel.org/stable/c/1cb7fdb1dfde1aab66780b4ba44dba6402172111\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: fix memory corruption bug with suspend and rebuild\\n\\nThe ice driver would previously panic after suspend. This is caused\\nfrom the driver *only* calling the ice_vsi_free_q_vectors() function by\\nitself, when it is suspending. Since commit b3e7b3a6ee92 (\\\"ice: prevent\\nNULL pointer deref during reload\\\") the driver has zeroed out\\nnum_q_vectors, and only restored it in ice_vsi_cfg_def().\\n\\nThis further causes the ice_rebuild() function to allocate a zero length\\nbuffer, after which num_q_vectors is updated, and then the new value of\\nnum_q_vectors is used to index into the zero length buffer, which\\ncorrupts memory.\\n\\nThe fix entails making sure all the code referencing num_q_vectors only\\ndoes so after it has been reset via ice_vsi_cfg_def().\\n\\nI didn\u0027t perform a full bisect, but I was able to test against 6.1.77\\nkernel and that ice driver works fine for suspend/resume with no panic,\\nso sometime since then, this problem was introduced.\\n\\nAlso clean up an un-needed init of a local variable in the function\\nbeing modified.\\n\\nPANIC from 6.8.0-rc1:\\n\\n[1026674.915596] PM: suspend exit\\n[1026675.664697] ice 0000:17:00.1: PTP reset successful\\n[1026675.664707] ice 0000:17:00.1: 2755 msecs passed between update to cached PHC time\\n[1026675.667660] ice 0000:b1:00.0: PTP reset successful\\n[1026675.675944] ice 0000:b1:00.0: 2832 msecs passed between update to cached PHC time\\n[1026677.137733] ixgbe 0000:31:00.0 ens787: NIC Link is Up 1 Gbps, Flow Control: None\\n[1026677.190201] BUG: kernel NULL pointer dereference, address: 0000000000000010\\n[1026677.192753] ice 0000:17:00.0: PTP reset successful\\n[1026677.192764] ice 0000:17:00.0: 4548 msecs passed between update to cached PHC time\\n[1026677.197928] #PF: supervisor read access in kernel mode\\n[1026677.197933] #PF: error_code(0x0000) - not-present page\\n[1026677.197937] PGD 1557a7067 P4D 0\\n[1026677.212133] ice 0000:b1:00.1: PTP reset successful\\n[1026677.212143] ice 0000:b1:00.1: 4344 msecs passed between update to cached PHC time\\n[1026677.212575]\\n[1026677.243142] Oops: 0000 [#1] PREEMPT SMP NOPTI\\n[1026677.247918] CPU: 23 PID: 42790 Comm: kworker/23:0 Kdump: loaded Tainted: G        W          6.8.0-rc1+ #1\\n[1026677.257989] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022\\n[1026677.269367] Workqueue: ice ice_service_task [ice]\\n[1026677.274592] RIP: 0010:ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice]\\n[1026677.281421] Code: 0f 84 3a ff ff ff 41 0f b7 74 ec 02 66 89 b0 22 02 00 00 81 e6 ff 1f 00 00 e8 ec fd ff ff e9 35 ff ff ff 48 8b 43 30 49 63 ed \u003c41\u003e 0f b7 34 24 41 83 c5 01 48 8b 3c e8 66 89 b7 aa 02 00 00 81 e6\\n[1026677.300877] RSP: 0018:ff3be62a6399bcc0 EFLAGS: 00010202\\n[1026677.306556] RAX: ff28691e28980828 RBX: ff28691e41099828 RCX: 0000000000188000\\n[1026677.314148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff28691e41099828\\n[1026677.321730] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\\n[1026677.329311] R10: 0000000000000007 R11: ffffffffffffffc0 R12: 0000000000000010\\n[1026677.336896] R13: 0000000000000000 R14: 0000000000000000 R15: ff28691e0eaa81a0\\n[1026677.344472] FS:  0000000000000000(0000) GS:ff28693cbffc0000(0000) knlGS:0000000000000000\\n[1026677.353000] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[1026677.359195] CR2: 0000000000000010 CR3: 0000000128df4001 CR4: 0000000000771ef0\\n[1026677.366779] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n[1026677.374369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n[1026677.381952] PKRU: 55555554\\n[1026677.385116] Call Trace:\\n[1026677.388023]  \u003cTASK\u003e\\n[1026677.390589]  ? __die+0x20/0x70\\n[1026677.394105]  ? page_fault_oops+0x82/0x160\\n[1026677.398576]  ? do_user_addr_fault+0x65/0x6a0\\n[1026677.403307]  ? exc_page_fault+0x6a/0x150\\n[1026677.407694]  ? asm_exc_page_fault+0x22/0x30\\n[1026677.412349]  ? ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice]\\n[1026677.4186\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.26\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.5\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.4.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:45:13.380Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35911\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:45:13.380Z\", \"dateReserved\": \"2024-05-17T13:50:33.121Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-19T08:35:04.299Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.