{
  "threat_severity" : "Moderate",
  "public_date" : "2024-04-17T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: igc: avoid returning frame twice in XDP_REDIRECT",
    "id" : "2275748",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2275748"
  },
  "cvss3" : {
    "cvss3_base_score" : "4.4",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-20",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nigc: avoid returning frame twice in XDP_REDIRECT\nWhen a frame can not be transmitted in XDP_REDIRECT\n(e.g. due to a full queue), it is necessary to free\nit by calling xdp_return_frame_rx_napi.\nHowever, this is the responsibility of the caller of\nthe ndo_xdp_xmit (see for example bq_xmit_all in\nkernel/bpf/devmap.c) and thus calling it inside\nigc_xdp_xmit (which is the ndo_xdp_xmit of the igc\ndriver) as well will lead to memory corruption.\nIn fact, bq_xmit_all expects that it can return all\nframes after the last successfully transmitted one.\nTherefore, break for the first not transmitted frame,\nbut do not call xdp_return_frame_rx_napi in igc_xdp_xmit.\nThis is equally implemented in other Intel drivers\nsuch as the igb.\nThere are two alternatives to this that were rejected:\n1. Return num_frames as all the frames would have been\ntransmitted and release them inside igc_xdp_xmit.\nWhile it might work technically, it is not what\nthe return value is meant to represent (i.e. the\nnumber of SUCCESSFULLY transmitted packets).\n2. Rework kernel/bpf/devmap.c and all drivers to\nsupport non-consecutively dropped packets.\nBesides being complex, it likely has a negative\nperformance impact without a significant gain\nsince it is anyway unlikely that the next frame\ncan be transmitted if the previous one was dropped.\nThe memory corruption can be reproduced with\nthe following script which leads to a kernel panic\nafter a few seconds.  It basically generates more\ntraffic than a i225 NIC can transmit and pushes it\nvia XDP_REDIRECT from a virtual interface to the\nphysical interface where frames get dropped.\n#!/bin/bash\nINTERFACE=enp4s0\nINTERFACE_IDX=`cat /sys/class/net/$INTERFACE/ifindex`\nsudo ip link add dev veth1 type veth peer name veth2\nsudo ip link set up $INTERFACE\nsudo ip link set up veth1\nsudo ip link set up veth2\ncat << EOF > redirect.bpf.c\nSEC(\"prog\")\nint redirect(struct xdp_md *ctx)\n{\nreturn bpf_redirect($INTERFACE_IDX, 0);\n}\nchar _license[] SEC(\"license\") = \"GPL\";\nEOF\nclang -O2 -g -Wall -target bpf -c redirect.bpf.c -o redirect.bpf.o\nsudo ip link set veth2 xdp obj redirect.bpf.o\ncat << EOF > pass.bpf.c\nSEC(\"prog\")\nint pass(struct xdp_md *ctx)\n{\nreturn XDP_PASS;\n}\nchar _license[] SEC(\"license\") = \"GPL\";\nEOF\nclang -O2 -g -Wall -target bpf -c pass.bpf.c -o pass.bpf.o\nsudo ip link set $INTERFACE xdp obj pass.bpf.o\ncat << EOF > trafgen.cfg\n{\n/* Ethernet Header */\n0xe8, 0x6a, 0x64, 0x41, 0xbf, 0x46,\n0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,\nconst16(ETH_P_IP),\n/* IPv4 Header */\n0b01000101, 0,   # IPv4 version, IHL, TOS\nconst16(1028),   # IPv4 total length (UDP length + 20 bytes (IP header))\nconst16(2),      # IPv4 ident\n0b01000000, 0,   # IPv4 flags, fragmentation off\n64,              # IPv4 TTL\n17,              # Protocol UDP\ncsumip(14, 33),  # IPv4 checksum\n/* UDP Header */\n10,  0, 1, 1,    # IP Src - adapt as needed\n10,  0, 1, 2,    # IP Dest - adapt as needed\nconst16(6666),   # UDP Src Port\nconst16(6666),   # UDP Dest Port\nconst16(1008),   # UDP length (UDP header 8 bytes + payload length)\ncsumudp(14, 34), # UDP checksum\n/* Payload */\nfill('W', 1000),\n}\nEOF\nsudo trafgen -i trafgen.cfg -b3000MB -o veth1 --cpp", "A memory corruption flaw was found in the Linux kernel’s Intel(R) Ethernet Controller I225-LM/I225-V driver in how a user generates a high amount of packets. This flaw allows a local user to crash the system." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-08-08T00:00:00Z",
    "advisory" : "RHSA-2024:5102",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-08-08T00:00:00Z",
    "advisory" : "RHSA-2024:5101",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.16.1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Extended Update Support",
    "release_date" : "2024-09-03T00:00:00Z",
    "advisory" : "RHSA-2024:6206",
    "cpe" : "cpe:/o:redhat:rhel_eus:8.8",
    "package" : "kernel-0:4.18.0-477.70.1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-08-15T00:00:00Z",
    "advisory" : "RHSA-2024:5363",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-427.31.1.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-08-15T00:00:00Z",
    "advisory" : "RHSA-2024:5363",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-427.31.1.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Extended Update Support",
    "release_date" : "2024-08-21T00:00:00Z",
    "advisory" : "RHSA-2024:5672",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.2",
    "package" : "kernel-0:5.14.0-284.80.1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Extended Update Support",
    "release_date" : "2024-08-21T00:00:00Z",
    "advisory" : "RHSA-2024:5673",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.2::nfv",
    "package" : "kernel-rt-0:5.14.0-284.80.1.rt14.365.el9_2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-26853\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26853\nhttps://lore.kernel.org/linux-cve-announce/2024041723-CVE-2024-26853-b549@gregkh/T" ],
  "name" : "CVE-2024-26853",
  "csaw" : false
}