CVE-2024-26698

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-26698
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26698.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-26698
Related
Published
2024-04-03T15:15:52Z
Modified
2024-09-18T03:26:01.618889Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

hvnetvsc: Fix race condition between netvscprobe and netvsc_remove

In commit ac5047671758 ("hvnetvsc: Disable NAPI before closing the VMBus channel"), napidisable was getting called for all channels, including all subchannels without confirming if they are enabled or not.

This caused hvnetvsc getting hung at napidisable, when netvscprobe() has finished running but nvdev->subchanwork has not started yet. netvscsubchanwork() -> rndissetsubchannel() has not created the sub-channels and because of that netvscscopen() is not running. netvscremove() calls cancelworksync(&nvdev->subchanwork), for which netvscsubchanwork did not run.

netifnapiadd() sets the bit NAPISTATESCHED because it ensures NAPI cannot be scheduled. Then netvscscopen() -> napienable will clear the NAPIFSTATESCHED bit, so it can be scheduled. napidisable() does the opposite.

Now during netvscdeviceremove(), when napidisable is called for those subchannels, napidisable gets stuck on infinite msleep.

This fix addresses this problem by ensuring that napidisable() is not getting called for non-enabled NAPI struct. But netifnapi_del() is still necessary for these non-enabled NAPI struct for cleanup purpose.

Call trace: [ 654.559417] task:modprobe state:D stack: 0 pid: 2321 ppid: 1091 flags:0x00004002 [ 654.568030] Call Trace: [ 654.571221] <TASK> [ 654.573790] _schedule+0x2d6/0x960 [ 654.577733] schedule+0x69/0xf0 [ 654.581214] scheduletimeout+0x87/0x140 [ 654.585463] ? _bpftracetickstop+0x20/0x20 [ 654.590291] msleep+0x2d/0x40 [ 654.593625] napidisable+0x2b/0x80 [ 654.597437] netvscdeviceremove+0x8a/0x1f0 [hvnetvsc] [ 654.603935] rndisfilterdeviceremove+0x194/0x1c0 [hvnetvsc] [ 654.611101] ? dowaitintr+0xb0/0xb0 [ 654.615753] netvscremove+0x7c/0x120 [hvnetvsc] [ 654.621675] vmbusremove+0x27/0x40 [hvvmbus]

References

Affected packages

Debian:11 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.10.216-1

Affected versions

5.*

5.10.46-4
5.10.46-5
5.10.70-1~bpo10+1
5.10.70-1
5.10.84-1
5.10.92-1~bpo10+1
5.10.92-1
5.10.92-2
5.10.103-1~bpo10+1
5.10.103-1
5.10.106-1
5.10.113-1
5.10.120-1~bpo10+1
5.10.120-1
5.10.127-1
5.10.127-2~bpo10+1
5.10.127-2
5.10.136-1
5.10.140-1
5.10.148-1
5.10.149-1
5.10.149-2
5.10.158-1
5.10.158-2
5.10.162-1
5.10.178-1
5.10.178-2
5.10.178-3
5.10.179-1
5.10.179-2
5.10.179-3
5.10.179-4
5.10.179-5
5.10.191-1
5.10.197-1
5.10.205-1
5.10.205-2
5.10.209-1
5.10.209-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.82-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.7.7-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1
6.6.8-1
6.6.9-1
6.6.11-1
6.6.13-1~bpo12+1
6.6.13-1
6.6.15-1
6.6.15-2
6.7-1~exp1
6.7.1-1~exp1
6.7.4-1~exp1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}