GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-56649 (GCVE-0-2024-56649)

Vulnerability from cvelistv5 – Published: 2024-12-27 15:02 – Updated: 2026-05-11 20:56
VLAI
Title
net: enetc: Do not configure preemptible TCs if SIs do not support
Summary
In the Linux kernel, the following vulnerability has been resolved: net: enetc: Do not configure preemptible TCs if SIs do not support Both ENETC PF and VF drivers share enetc_setup_tc_mqprio() to configure MQPRIO. And enetc_setup_tc_mqprio() calls enetc_change_preemptible_tcs() to configure preemptible TCs. However, only PF is able to configure preemptible TCs. Because only PF has related registers, while VF does not have these registers. So for VF, its hw->port pointer is NULL. Therefore, VF will access an invalid pointer when accessing a non-existent register, which will cause a crash issue. The simplified log is as follows. root@ls1028ardb:~# tc qdisc add dev eno0vf0 parent root handle 100: \ mqprio num_tc 4 map 0 0 1 1 2 2 3 3 queues 1@0 1@1 1@2 1@3 hw 1 [ 187.290775] Unable to handle kernel paging request at virtual address 0000000000001f00 [ 187.424831] pc : enetc_mm_commit_preemptible_tcs+0x1c4/0x400 [ 187.430518] lr : enetc_mm_commit_preemptible_tcs+0x30c/0x400 [ 187.511140] Call trace: [ 187.513588] enetc_mm_commit_preemptible_tcs+0x1c4/0x400 [ 187.518918] enetc_setup_tc_mqprio+0x180/0x214 [ 187.523374] enetc_vf_setup_tc+0x1c/0x30 [ 187.527306] mqprio_enable_offload+0x144/0x178 [ 187.531766] mqprio_init+0x3ec/0x668 [ 187.535351] qdisc_create+0x15c/0x488 [ 187.539023] tc_modify_qdisc+0x398/0x73c [ 187.542958] rtnetlink_rcv_msg+0x128/0x378 [ 187.547064] netlink_rcv_skb+0x60/0x130 [ 187.550910] rtnetlink_rcv+0x18/0x24 [ 187.554492] netlink_unicast+0x300/0x36c [ 187.558425] netlink_sendmsg+0x1a8/0x420 [ 187.606759] ---[ end trace 0000000000000000 ]--- In addition, some PFs also do not support configuring preemptible TCs, such as eno1 and eno3 on LS1028A. It won't crash like it does for VFs, but we should prevent these PFs from accessing these unimplemented registers.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:00 UTC
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 827145392a4aad635b93e5235b7d7fecc2fa31c7 , < 66127f0d1ecf00604aeab71132bde398fd9ec7c9 (git)
Affected: 827145392a4aad635b93e5235b7d7fecc2fa31c7 , < b718b68a9964181e24d15138a09ce95785a19002 (git)
Affected: 827145392a4aad635b93e5235b7d7fecc2fa31c7 , < b2420b8c81ec674552d00c55d46245e5c184b260 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.66 , ≤ 6.6.* (semver)
Unaffected: 6.12.5 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56649",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:00:25.888929Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:07:11.282Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/freescale/enetc/enetc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "66127f0d1ecf00604aeab71132bde398fd9ec7c9",
              "status": "affected",
              "version": "827145392a4aad635b93e5235b7d7fecc2fa31c7",
              "versionType": "git"
            },
            {
              "lessThan": "b718b68a9964181e24d15138a09ce95785a19002",
              "status": "affected",
              "version": "827145392a4aad635b93e5235b7d7fecc2fa31c7",
              "versionType": "git"
            },
            {
              "lessThan": "b2420b8c81ec674552d00c55d46245e5c184b260",
              "status": "affected",
              "version": "827145392a4aad635b93e5235b7d7fecc2fa31c7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/freescale/enetc/enetc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: enetc: Do not configure preemptible TCs if SIs do not support\n\nBoth ENETC PF and VF drivers share enetc_setup_tc_mqprio() to configure\nMQPRIO. And enetc_setup_tc_mqprio() calls enetc_change_preemptible_tcs()\nto configure preemptible TCs. However, only PF is able to configure\npreemptible TCs. Because only PF has related registers, while VF does not\nhave these registers. So for VF, its hw-\u003eport pointer is NULL. Therefore,\nVF will access an invalid pointer when accessing a non-existent register,\nwhich will cause a crash issue. The simplified log is as follows.\n\nroot@ls1028ardb:~# tc qdisc add dev eno0vf0 parent root handle 100: \\\nmqprio num_tc 4 map 0 0 1 1 2 2 3 3 queues 1@0 1@1 1@2 1@3 hw 1\n[  187.290775] Unable to handle kernel paging request at virtual address 0000000000001f00\n[  187.424831] pc : enetc_mm_commit_preemptible_tcs+0x1c4/0x400\n[  187.430518] lr : enetc_mm_commit_preemptible_tcs+0x30c/0x400\n[  187.511140] Call trace:\n[  187.513588]  enetc_mm_commit_preemptible_tcs+0x1c4/0x400\n[  187.518918]  enetc_setup_tc_mqprio+0x180/0x214\n[  187.523374]  enetc_vf_setup_tc+0x1c/0x30\n[  187.527306]  mqprio_enable_offload+0x144/0x178\n[  187.531766]  mqprio_init+0x3ec/0x668\n[  187.535351]  qdisc_create+0x15c/0x488\n[  187.539023]  tc_modify_qdisc+0x398/0x73c\n[  187.542958]  rtnetlink_rcv_msg+0x128/0x378\n[  187.547064]  netlink_rcv_skb+0x60/0x130\n[  187.550910]  rtnetlink_rcv+0x18/0x24\n[  187.554492]  netlink_unicast+0x300/0x36c\n[  187.558425]  netlink_sendmsg+0x1a8/0x420\n[  187.606759] ---[ end trace 0000000000000000 ]---\n\nIn addition, some PFs also do not support configuring preemptible TCs,\nsuch as eno1 and eno3 on LS1028A. It won\u0027t crash like it does for VFs,\nbut we should prevent these PFs from accessing these unimplemented\nregisters."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:56:34.332Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/66127f0d1ecf00604aeab71132bde398fd9ec7c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/b718b68a9964181e24d15138a09ce95785a19002"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2420b8c81ec674552d00c55d46245e5c184b260"
        }
      ],
      "title": "net: enetc: Do not configure preemptible TCs if SIs do not support",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56649",
    "datePublished": "2024-12-27T15:02:49.412Z",
    "dateReserved": "2024-12-27T15:00:39.840Z",
    "dateUpdated": "2026-05-11T20:56:34.332Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56649",
      "date": "2026-09-14",
      "epss": "0.00229",
      "percentile": "0.13787"
    },
    "microsoft_vex": {
      "current_release_date": "2025-03-13T00:00:00.000Z",
      "cve": "CVE-2024-56649",
      "id": "msrc_CVE-2024-56649",
      "initial_release_date": "2024-12-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: enetc: Do not configure preemptible TCs if SIs do not support",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-56649.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56649\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:24.680\",\"lastModified\":\"2026-06-17T08:12:38.643\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: enetc: Do not configure preemptible TCs if SIs do not support\\n\\nBoth ENETC PF and VF drivers share enetc_setup_tc_mqprio() to configure\\nMQPRIO. And enetc_setup_tc_mqprio() calls enetc_change_preemptible_tcs()\\nto configure preemptible TCs. However, only PF is able to configure\\npreemptible TCs. Because only PF has related registers, while VF does not\\nhave these registers. So for VF, its hw-\u003eport pointer is NULL. Therefore,\\nVF will access an invalid pointer when accessing a non-existent register,\\nwhich will cause a crash issue. The simplified log is as follows.\\n\\nroot@ls1028ardb:~# tc qdisc add dev eno0vf0 parent root handle 100: \\\\\\nmqprio num_tc 4 map 0 0 1 1 2 2 3 3 queues 1@0 1@1 1@2 1@3 hw 1\\n[  187.290775] Unable to handle kernel paging request at virtual address 0000000000001f00\\n[  187.424831] pc : enetc_mm_commit_preemptible_tcs+0x1c4/0x400\\n[  187.430518] lr : enetc_mm_commit_preemptible_tcs+0x30c/0x400\\n[  187.511140] Call trace:\\n[  187.513588]  enetc_mm_commit_preemptible_tcs+0x1c4/0x400\\n[  187.518918]  enetc_setup_tc_mqprio+0x180/0x214\\n[  187.523374]  enetc_vf_setup_tc+0x1c/0x30\\n[  187.527306]  mqprio_enable_offload+0x144/0x178\\n[  187.531766]  mqprio_init+0x3ec/0x668\\n[  187.535351]  qdisc_create+0x15c/0x488\\n[  187.539023]  tc_modify_qdisc+0x398/0x73c\\n[  187.542958]  rtnetlink_rcv_msg+0x128/0x378\\n[  187.547064]  netlink_rcv_skb+0x60/0x130\\n[  187.550910]  rtnetlink_rcv+0x18/0x24\\n[  187.554492]  netlink_unicast+0x300/0x36c\\n[  187.558425]  netlink_sendmsg+0x1a8/0x420\\n[  187.606759] ---[ end trace 0000000000000000 ]---\\n\\nIn addition, some PFs also do not support configuring preemptible TCs,\\nsuch as eno1 and eno3 on LS1028A. It won\u0027t crash like it does for VFs,\\nbut we should prevent these PFs from accessing these unimplemented\\nregisters.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: enetc: No configure TC preemptibles si los SI no son compatibles Ambos controladores ENETC PF y VF comparten enetc_setup_tc_mqprio() para configurar MQPRIO. Y enetc_setup_tc_mqprio() llama a enetc_change_preemptible_tcs() para configurar TC preemptibles. Sin embargo, solo PF puede configurar TC preemptibles. Porque solo PF tiene registros relacionados, mientras que VF no tiene estos registros. Entonces, para VF, su puntero hw-\u0026gt;port es NULL. Por lo tanto, VF acceder\u00e1 a un puntero no v\u00e1lido cuando acceda a un registro inexistente, lo que provocar\u00e1 un problema de bloqueo. El registro simplificado es el siguiente. root@ls1028ardb:~# tc qdisc add dev eno0vf0 parent root handle 100: \\\\ mqprio num_tc 4 map 0 0 1 1 2 2 3 3 queues 1@0 1@1 1@2 1@3 hw 1 [ 187.290775] No se puede gestionar la solicitud de paginaci\u00f3n del n\u00facleo en la direcci\u00f3n virtual 0000000000001f00 [ 187.424831] pc : enetc_mm_commit_preemptible_tcs+0x1c4/0x400 [ 187.430518] lr : enetc_mm_commit_preemptible_tcs+0x30c/0x400 [ 187.511140] Rastreo de llamada: [ 187.513588] enetc_mm_commit_preemptible_tcs+0x1c4/0x400 [ 187.518918] enetc_setup_tc_mqprio+0x180/0x214 [ 187.523374] enetc_vf_setup_tc+0x1c/0x30 [ 187.527306] mqprio_enable_offload+0x144/0x178 [ 187.531766] mqprio_init+0x3ec/0x668 [ 187.535351] qdisc_create+0x15c/0x488 [ 187.539023] tc_modify_qdisc+0x398/0x73c [ 187.542958] rtnetlink_rcv_msg+0x128/0x378 [ 187.547064] netlink_rcv_skb+0x60/0x130 [ 187.550910] rtnetlink_rcv+0x18/0x24 [ 187.554492] netlink_unicast+0x300/0x36c [ 187.558425] netlink_sendmsg+0x1a8/0x420 [ 187.606759] ---[ fin de seguimiento 0000000000000000 ]--- Adem\u00e1s, algunos PF tampoco admiten la configuraci\u00f3n de TC interrumpibles, como eno1 y eno3 en LS1028A. No se bloquear\u00e1 como ocurre con los VF, pero debemos evitar que estos PF accedan a estos registros no implementados.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/freescale/enetc/enetc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"827145392a4aad635b93e5235b7d7fecc2fa31c7\",\"lessThan\":\"66127f0d1ecf00604aeab71132bde398fd9ec7c9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"827145392a4aad635b93e5235b7d7fecc2fa31c7\",\"lessThan\":\"b718b68a9964181e24d15138a09ce95785a19002\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"827145392a4aad635b93e5235b7d7fecc2fa31c7\",\"lessThan\":\"b2420b8c81ec674552d00c55d46245e5c184b260\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/freescale/enetc/enetc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.66\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.5\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T20:00:25.888929Z\",\"id\":\"CVE-2024-56649\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4\",\"versionEndExcluding\":\"6.6.66\",\"matchCriteriaId\":\"26B700EE-A79C-4047-8214-099FACC0BEB5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.5\",\"matchCriteriaId\":\"9501D045-7A94-42CA-8B03-821BE94A65B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/66127f0d1ecf00604aeab71132bde398fd9ec7c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b2420b8c81ec674552d00c55d46245e5c184b260\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b718b68a9964181e24d15138a09ce95785a19002\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T13:58:17+00:00",
      "cve": "CVE-2024-56649",
      "id": "CVE-2024-56649",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: enetc: Do not configure preemptible TCs if SIs do not support",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56649.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56649\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:00:25.888929Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:44:33.517Z\"}}], \"cna\": {\"title\": \"net: enetc: Do not configure preemptible TCs if SIs do not support\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"827145392a4aad635b93e5235b7d7fecc2fa31c7\", \"lessThan\": \"66127f0d1ecf00604aeab71132bde398fd9ec7c9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"827145392a4aad635b93e5235b7d7fecc2fa31c7\", \"lessThan\": \"b718b68a9964181e24d15138a09ce95785a19002\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"827145392a4aad635b93e5235b7d7fecc2fa31c7\", \"lessThan\": \"b2420b8c81ec674552d00c55d46245e5c184b260\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/freescale/enetc/enetc.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.66\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/freescale/enetc/enetc.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/66127f0d1ecf00604aeab71132bde398fd9ec7c9\"}, {\"url\": \"https://git.kernel.org/stable/c/b718b68a9964181e24d15138a09ce95785a19002\"}, {\"url\": \"https://git.kernel.org/stable/c/b2420b8c81ec674552d00c55d46245e5c184b260\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: enetc: Do not configure preemptible TCs if SIs do not support\\n\\nBoth ENETC PF and VF drivers share enetc_setup_tc_mqprio() to configure\\nMQPRIO. And enetc_setup_tc_mqprio() calls enetc_change_preemptible_tcs()\\nto configure preemptible TCs. However, only PF is able to configure\\npreemptible TCs. Because only PF has related registers, while VF does not\\nhave these registers. So for VF, its hw-\u003eport pointer is NULL. Therefore,\\nVF will access an invalid pointer when accessing a non-existent register,\\nwhich will cause a crash issue. The simplified log is as follows.\\n\\nroot@ls1028ardb:~# tc qdisc add dev eno0vf0 parent root handle 100: \\\\\\nmqprio num_tc 4 map 0 0 1 1 2 2 3 3 queues 1@0 1@1 1@2 1@3 hw 1\\n[  187.290775] Unable to handle kernel paging request at virtual address 0000000000001f00\\n[  187.424831] pc : enetc_mm_commit_preemptible_tcs+0x1c4/0x400\\n[  187.430518] lr : enetc_mm_commit_preemptible_tcs+0x30c/0x400\\n[  187.511140] Call trace:\\n[  187.513588]  enetc_mm_commit_preemptible_tcs+0x1c4/0x400\\n[  187.518918]  enetc_setup_tc_mqprio+0x180/0x214\\n[  187.523374]  enetc_vf_setup_tc+0x1c/0x30\\n[  187.527306]  mqprio_enable_offload+0x144/0x178\\n[  187.531766]  mqprio_init+0x3ec/0x668\\n[  187.535351]  qdisc_create+0x15c/0x488\\n[  187.539023]  tc_modify_qdisc+0x398/0x73c\\n[  187.542958]  rtnetlink_rcv_msg+0x128/0x378\\n[  187.547064]  netlink_rcv_skb+0x60/0x130\\n[  187.550910]  rtnetlink_rcv+0x18/0x24\\n[  187.554492]  netlink_unicast+0x300/0x36c\\n[  187.558425]  netlink_sendmsg+0x1a8/0x420\\n[  187.606759] ---[ end trace 0000000000000000 ]---\\n\\nIn addition, some PFs also do not support configuring preemptible TCs,\\nsuch as eno1 and eno3 on LS1028A. It won\u0027t crash like it does for VFs,\\nbut we should prevent these PFs from accessing these unimplemented\\nregisters.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.66\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.5\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"6.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T10:01:01.604Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56649\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-01T20:07:11.282Z\", \"dateReserved\": \"2024-12-27T15:00:39.840Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T15:02:49.412Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.