CVE-2024-42302
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2024-12-19 09:15
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal Keith reports a use-after-free when a DPC event occurs concurrently to hot-removal of the same portion of the hierarchy: The dpc_handler() awaits readiness of the secondary bus below the Downstream Port where the DPC event occurred. To do so, it polls the config space of the first child device on the secondary bus. If that child device is concurrently removed, accesses to its struct pci_dev cause the kernel to oops. That's because pci_bridge_wait_for_secondary_bus() neglects to hold a reference on the child device. Before v6.3, the function was only called on resume from system sleep or on runtime resume. Holding a reference wasn't necessary back then because the pciehp IRQ thread could never run concurrently. (On resume from system sleep, IRQs are not enabled until after the resume_noirq phase. And runtime resume is always awaited before a PCI device is removed.) However starting with v6.3, pci_bridge_wait_for_secondary_bus() is also called on a DPC event. Commit 53b54ad074de ("PCI/DPC: Await readiness of secondary bus after reset"), which introduced that, failed to appreciate that pci_bridge_wait_for_secondary_bus() now needs to hold a reference on the child device because dpc_handler() and pciehp may indeed run concurrently. The commit was backported to v5.10+ stable kernels, so that's the oldest one affected. Add the missing reference acquisition. Abridged stack trace: BUG: unable to handle page fault for address: 00000000091400c0 CPU: 15 PID: 2464 Comm: irq/53-pcie-dpc 6.9.0 RIP: pci_bus_read_config_dword+0x17/0x50 pci_dev_wait() pci_bridge_wait_for_secondary_bus() dpc_reset_link() pcie_do_recovery() dpc_handler()
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/11a1f4bc47362700fcbde717292158873fb847edPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2c111413f38ca5cf87557cab89f6d82b0e3433e7Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2cc8973bdc4d6c928ebe38b88090a2cdfe81f42fPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b16f3ea1db47a6766a9f1169244cf1fc287a7c62Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c52f9e1a9eb40f13993142c331a6cfd334d4b91dPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f63df70b439bb8331358a306541893bf415bf1daPatch
Impacted products
Vendor Product Version
Linux Linux Version: 6.3
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42302",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:10:28.656566Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:28.331Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c52f9e1a9eb40f13993142c331a6cfd334d4b91d",
              "status": "affected",
              "version": "d0292124bb5787a2f1ab1316509e801ca89c10fb",
              "versionType": "git"
            },
            {
              "lessThan": "2c111413f38ca5cf87557cab89f6d82b0e3433e7",
              "status": "affected",
              "version": "ffe2318405e605f1b3985ce188eff69e6d1d1baa",
              "versionType": "git"
            },
            {
              "lessThan": "f63df70b439bb8331358a306541893bf415bf1da",
              "status": "affected",
              "version": "189f856e76f5463f59efb5fc18dcc1692d04c41a",
              "versionType": "git"
            },
            {
              "lessThan": "2cc8973bdc4d6c928ebe38b88090a2cdfe81f42f",
              "status": "affected",
              "version": "53b54ad074de1896f8b021615f65b27f557ce874",
              "versionType": "git"
            },
            {
              "lessThan": "b16f3ea1db47a6766a9f1169244cf1fc287a7c62",
              "status": "affected",
              "version": "53b54ad074de1896f8b021615f65b27f557ce874",
              "versionType": "git"
            },
            {
              "lessThan": "11a1f4bc47362700fcbde717292158873fb847ed",
              "status": "affected",
              "version": "53b54ad074de1896f8b021615f65b27f557ce874",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/DPC: Fix use-after-free on concurrent DPC and hot-removal\n\nKeith reports a use-after-free when a DPC event occurs concurrently to\nhot-removal of the same portion of the hierarchy:\n\nThe dpc_handler() awaits readiness of the secondary bus below the\nDownstream Port where the DPC event occurred.  To do so, it polls the\nconfig space of the first child device on the secondary bus.  If that\nchild device is concurrently removed, accesses to its struct pci_dev\ncause the kernel to oops.\n\nThat\u0027s because pci_bridge_wait_for_secondary_bus() neglects to hold a\nreference on the child device.  Before v6.3, the function was only\ncalled on resume from system sleep or on runtime resume.  Holding a\nreference wasn\u0027t necessary back then because the pciehp IRQ thread\ncould never run concurrently.  (On resume from system sleep, IRQs are\nnot enabled until after the resume_noirq phase.  And runtime resume is\nalways awaited before a PCI device is removed.)\n\nHowever starting with v6.3, pci_bridge_wait_for_secondary_bus() is also\ncalled on a DPC event.  Commit 53b54ad074de (\"PCI/DPC: Await readiness\nof secondary bus after reset\"), which introduced that, failed to\nappreciate that pci_bridge_wait_for_secondary_bus() now needs to hold a\nreference on the child device because dpc_handler() and pciehp may\nindeed run concurrently.  The commit was backported to v5.10+ stable\nkernels, so that\u0027s the oldest one affected.\n\nAdd the missing reference acquisition.\n\nAbridged stack trace:\n\n  BUG: unable to handle page fault for address: 00000000091400c0\n  CPU: 15 PID: 2464 Comm: irq/53-pcie-dpc 6.9.0\n  RIP: pci_bus_read_config_dword+0x17/0x50\n  pci_dev_wait()\n  pci_bridge_wait_for_secondary_bus()\n  dpc_reset_link()\n  pcie_do_recovery()\n  dpc_handler()"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:15:58.816Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c52f9e1a9eb40f13993142c331a6cfd334d4b91d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c111413f38ca5cf87557cab89f6d82b0e3433e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/f63df70b439bb8331358a306541893bf415bf1da"
        },
        {
          "url": "https://git.kernel.org/stable/c/2cc8973bdc4d6c928ebe38b88090a2cdfe81f42f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b16f3ea1db47a6766a9f1169244cf1fc287a7c62"
        },
        {
          "url": "https://git.kernel.org/stable/c/11a1f4bc47362700fcbde717292158873fb847ed"
        }
      ],
      "title": "PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42302",
    "datePublished": "2024-08-17T09:09:08.891Z",
    "dateReserved": "2024-07-30T07:40:12.272Z",
    "dateUpdated": "2024-12-19T09:15:58.816Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42302\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-17T09:15:10.487\",\"lastModified\":\"2024-08-22T16:37:26.237\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nPCI/DPC: Fix use-after-free on concurrent DPC and hot-removal\\n\\nKeith reports a use-after-free when a DPC event occurs concurrently to\\nhot-removal of the same portion of the hierarchy:\\n\\nThe dpc_handler() awaits readiness of the secondary bus below the\\nDownstream Port where the DPC event occurred.  To do so, it polls the\\nconfig space of the first child device on the secondary bus.  If that\\nchild device is concurrently removed, accesses to its struct pci_dev\\ncause the kernel to oops.\\n\\nThat\u0027s because pci_bridge_wait_for_secondary_bus() neglects to hold a\\nreference on the child device.  Before v6.3, the function was only\\ncalled on resume from system sleep or on runtime resume.  Holding a\\nreference wasn\u0027t necessary back then because the pciehp IRQ thread\\ncould never run concurrently.  (On resume from system sleep, IRQs are\\nnot enabled until after the resume_noirq phase.  And runtime resume is\\nalways awaited before a PCI device is removed.)\\n\\nHowever starting with v6.3, pci_bridge_wait_for_secondary_bus() is also\\ncalled on a DPC event.  Commit 53b54ad074de (\\\"PCI/DPC: Await readiness\\nof secondary bus after reset\\\"), which introduced that, failed to\\nappreciate that pci_bridge_wait_for_secondary_bus() now needs to hold a\\nreference on the child device because dpc_handler() and pciehp may\\nindeed run concurrently.  The commit was backported to v5.10+ stable\\nkernels, so that\u0027s the oldest one affected.\\n\\nAdd the missing reference acquisition.\\n\\nAbridged stack trace:\\n\\n  BUG: unable to handle page fault for address: 00000000091400c0\\n  CPU: 15 PID: 2464 Comm: irq/53-pcie-dpc 6.9.0\\n  RIP: pci_bus_read_config_dword+0x17/0x50\\n  pci_dev_wait()\\n  pci_bridge_wait_for_secondary_bus()\\n  dpc_reset_link()\\n  pcie_do_recovery()\\n  dpc_handler()\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: PCI/DPC: corrige el use-after-free en DPC simult\u00e1neos y la eliminaci\u00f3n en caliente. Keith informa un use-after-free cuando ocurre un evento de DPC simult\u00e1neamente con la eliminaci\u00f3n en caliente del mismo. parte de la jerarqu\u00eda: dpc_handler() espera que el bus secundario est\u00e9 listo debajo del puerto descendente donde ocurri\u00f3 el evento DPC. Para hacerlo, sondea el espacio de configuraci\u00f3n del primer dispositivo secundario en el bus secundario. Si ese dispositivo secundario se elimina simult\u00e1neamente, los accesos a su estructura pci_dev hacen que el kernel falle. Esto se debe a que pci_bridge_wait_for_secondary_bus() no mantiene una referencia en el dispositivo secundario. Antes de v6.3, la funci\u00f3n solo se llamaba al reanudar desde la suspensi\u00f3n del sistema o al reanudar el tiempo de ejecuci\u00f3n. Mantener una referencia no era necesario en aquel entonces porque el subproceso pciehp IRQ nunca pod\u00eda ejecutarse al mismo tiempo. (Al reanudar desde la suspensi\u00f3n del sistema, las IRQ no se habilitan hasta despu\u00e9s de la fase resume_noirq. Y la reanudaci\u00f3n del tiempo de ejecuci\u00f3n siempre se espera antes de que se elimine un dispositivo PCI). Sin embargo, a partir de v6.3, pci_bridge_wait_for_secondary_bus() tambi\u00e9n se llama en un evento DPC. El commit 53b54ad074de (\\\"PCI/DPC: Esperar la preparaci\u00f3n del bus secundario despu\u00e9s del reinicio\\\"), que introdujo eso, no pudo apreciar que pci_bridge_wait_for_secundary_bus() ahora necesita mantener una referencia en el dispositivo secundario porque dpc_handler() y pciehp pueden ejecutarse simult\u00e1neamente. El commit fue respaldada a n\u00facleos estables v5.10+, por lo que ese es el m\u00e1s antiguo afectado. Agregue la adquisici\u00f3n de referencia que falta. Seguimiento de pila abreviado: ERROR: no se puede manejar el error de p\u00e1gina para la direcci\u00f3n: 00000000091400c0 CPU: 15 PID: 2464 Comm: irq/53-pcie-dpc 6.9.0 RIP: pci_bus_read_config_dword+0x17/0x50 pci_dev_wait() pci_bridge_wait_for_secondary_bus() dpc_reset_link() _hacer_recuperaci\u00f3n () dpc_handler()\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.10.224\",\"matchCriteriaId\":\"8C51B278-A459-4B27-8CDF-1F3B85D9D08E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.165\",\"matchCriteriaId\":\"B4E2B568-3171-41DE-B519-F2B1A3600D94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.103\",\"matchCriteriaId\":\"E45EAC72-8329-4F99-8276-86AF9BB3496A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.44\",\"matchCriteriaId\":\"CC912330-6B41-4C6B-99AF-F3857FBACB6A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.3\",\"matchCriteriaId\":\"92D388F2-1EAF-4CFA-AC06-5B26D762EA7D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/11a1f4bc47362700fcbde717292158873fb847ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2c111413f38ca5cf87557cab89f6d82b0e3433e7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2cc8973bdc4d6c928ebe38b88090a2cdfe81f42f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b16f3ea1db47a6766a9f1169244cf1fc287a7c62\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c52f9e1a9eb40f13993142c331a6cfd334d4b91d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f63df70b439bb8331358a306541893bf415bf1da\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.