cbcvebase.
CVE-2024-41047
published 2024-07-29

CVE-2024-41047: In the Linux kernel, the following vulnerability has been resolved: i40e: Fix XDP program unloading while removing the driver The commit 6533e558c650 ("i40e…

PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.27%
19.4th percentile
In the Linux kernel, the following vulnerability has been resolved: i40e: Fix XDP program unloading while removing the driver The commit 6533e558c650 ("i40e: Fix reset path while removing the driver") introduced a new PF state "__I40E_IN_REMOVE" to block modifying the XDP program while the driver is being removed. Unfortunately, such a change is useful only if the ".ndo_bpf()" callback was called out of the rmmod context because unloading the existing XDP program is also a part of driver removing procedure. In other words, from the rmmod context the driver is expected to unload the XDP program without reporting any errors. Otherwise, the kernel warning with callstack is printed out to dmesg. Example failing scenario: 1. Load the i40e driver. 2. Load the XDP program. 3. Unload the i40e driver (using "rmmod" command). The example kernel warning log: [ +0.004646] WARNING: CPU: 94 PID: 10395 at net/core/dev.c:9290 unregister_netdevice_many_notify+0x7a9/0x870 [...] [ +0.010959] RIP: 0010:unregister_netdevice_many_notify+0x7a9/0x870 [...] [ +0.002726] Call Trace: [ +0.002457] [ +0.002119] ? __warn+0x80/0x120 [ +0.003245] ? unregister_netdevice_many_notify+0x7a9/0x870 [ +0.005586] ? report_bug+0x164/0x190 [ +0.003678] ? handle_bug+0x3c/0x80 [ +0.003503] ? exc_invalid_op+0x17/0x70 [ +0.003846] ? asm_exc_invalid_op+0x1a/0x20 [ +0.004200] ? unregister_netdevice_many_notify+0x7a9/0x870 [ +0.005579] ? unregister_netdevice_many_notify+0x3cc/0x870 [ +0.005586] unregister_netdevice_queue+0xf7/0x140 [ +0.004806] unregister_netdev+0x1c/0x30 [ +0.003933] i40e_vsi_release+0x87/0x2f0 [i40e] [ +0.004604] i40e_remove+0x1a1/0x420 [i40e] [ +0.004220] pci_device_remove+0x3f/0xb0 [ +0.003943] device_release_driver_internal+0x19f/0x200 [ +0.005243] driver_detach+0x48/0x90 [ +0.003586] bus_remove_driver+0x6d/0xf0 [ +0.003939] pci_unregister_driver+0x2e/0xb0 [ +0.004278] i40e_exit_module+0x10/0x5f0 [i40e] [ +0.004570] __do_sys_delete_module.isra.0+0x197/0x310 [ +0.005153] do_syscall_64+0x8

Affected

23 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.106-1 (bookworm)linux 6.1.106-1 (bookworm)
debianlinux-6.1< linux 6.1.106-1 (bookworm)linux 6.1.106-1 (bookworm)
linuxlinux
linuxlinux
linuxlinux>= 5.15.20 < 5.15.1635.15.163
linuxlinux>= 5.16.6 < 5.175.17
linuxlinux>= 6533e558c6505e94c3e0ed4281ed5e31ec985f4d < 4bc336b2345f1485438c0eb7246d9c8a8d09f8ff4bc336b2345f1485438c0eb7246d9c8a8d09f8ff
linuxlinux>= 6533e558c6505e94c3e0ed4281ed5e31ec985f4d < 5266302cb2c74d8ab0e9a69d5752fffaea70496e5266302cb2c74d8ab0e9a69d5752fffaea70496e
linuxlinux>= 6533e558c6505e94c3e0ed4281ed5e31ec985f4d < 0075b8c94d76830c7b6f018f6e4eeb0bf6465fdc0075b8c94d76830c7b6f018f6e4eeb0bf6465fdc
linuxlinux>= 6533e558c6505e94c3e0ed4281ed5e31ec985f4d < 01fc5142ae6b06b61ed51a624f2732d6525d8ea301fc5142ae6b06b61ed51a624f2732d6525d8ea3
linuxlinux>= b82364abc54b19829b26459989d2781fc4822c28 < b399a68054dfb36eed121846ef5fcddba40b7740b399a68054dfb36eed121846ef5fcddba40b7740
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.1.106-16.1.106-1
linuxlinux_kernel>= 0 < 6.9.10-16.9.10-1
linuxlinux_kernel>= 0 < 6.9.10-16.9.10-1
linuxlinux_kernel>= 0 < 5.15.0-121.1315.15.0-121.131
linuxlinux_kernel>= 0 < 6.8.0-48.486.8.0-48.48
linuxlinux_kernel>= 5.15.20 < 5.15.1635.15.163
linuxlinux_kernel>= 5.16.6 < 5.175.17
linuxlinux_kernel>= 5.17.1 < 6.1.1006.1.100
linuxlinux_kernel>= 6.2 < 6.6.416.6.41
linuxlinux_kernel>= 6.7 < 6.9.106.9.10

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_ubuntu6.3MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.