CVE-2024-42110— net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 548c237c0a9972df5d1afaca38aa733ee577128d< 4b3b6c7efee69f077b86ef7f088fb96768e46e1f | affected |
548c237c0a9972df5d1afaca38aa733ee577128d< e3af5b14e7632bf12058533d69055393e2d126c9 | affected | ||
548c237c0a9972df5d1afaca38aa733ee577128d< 858ae09f03677a4ab907a15516893bc2cc79d4c3 | affected | ||
548c237c0a9972df5d1afaca38aa733ee577128d< e15a5d821e5192a3769d846079bc9aa380139baf | affected | ||
3.9 | affected | ||
< 3.9 | unaffected | ||
6.1.98≤ 6.1.* | unaffected | ||
6.6.39≤ 6.6.* | unaffected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-42110
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() The following is emitted when using idxd (DSA) dmanegine as the data mover for ntb_transport that ntb_netdev uses. [74412.546922] BUG: using smp_processor_id() in preemptible [00000000] code: irq/52-idxd-por/14526 [74412.556784] caller is netif_rx_internal+0x42/0x130 [74412.562282] CPU: 6 PID: 14526 Comm: irq/52-idxd-por Not tainted 6.9.5 #5 [74412.569870] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.E9I.1752.P05.2402080856 02/08/2024 [74412.581699] Call Trace: [74412.584514] <TASK> [74412.586933] dump_stack_lvl+0x55/0x70 [74412.591129] check_preemption_disabled+0xc8/0xf0 [74412.596374] netif_rx_internal+0x42/0x130 [74412.600957] __netif_rx+0x20/0xd0 [74412.604743] ntb_netdev_rx_handler+0x66/0x150 [ntb_netdev] [74412.610985] ntb_complete_rxc+0xed/0x140 [ntb_transport] [74412.617010] ntb_rx_copy_callback+0x53/0x80 [ntb_transport] [74412.623332] idxd_dma_complete_txd+0xe3/0x160 [idxd] [74412.628963] idxd_wq_thread+0x1a6/0x2b0 [idxd] [74412.634046] irq_thread_fn+0x21/0x60 [74412.638134] ? irq_thread+0xa8/0x290 [74412.642218] irq_thread+0x1a0/0x290 [74412.646212] ? __pfx_irq_thread_fn+0x10/0x10 [74412.651071] ? __pfx_irq_thread_dtor+0x10/0x10 [74412.656117] ? __pfx_irq_thread+0x10/0x10 [74412.660686] kthread+0x100/0x130 [74412.664384] ? __pfx_kthread+0x10/0x10 [74412.668639] ret_from_fork+0x31/0x50 [74412.672716] ? __pfx_kthread+0x10/0x10 [74412.676978] ret_from_fork_asm+0x1a/0x30 [74412.681457] </TASK> The cause is due to the idxd driver interrupt completion handler uses threaded interrupt and the threaded handler is not hard or soft interrupt context. However __netif_rx() can only be called from interrupt context. Change the call to netif_rx() in order to allow completion via normal context for dmaengine drivers that utilize threaded irq handling. While the following commit changed from netif_rx() to __netif_rx(), baebdf48c360 ("net: dev: Makes sure netif_rx() can be invoked in any context."), the change should've been a noop instead. However, the code precedes this fix should've been using netif_rx_ni() or netif_rx_any_context().
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于net:ntb_netdev模块中在使用idxd (DSA) dmanegine作为ntb_transport的数据移动器时，idxd驱动程序的中断完成处理程序使用线程化中断，而线程处理程序不是硬中断或软中断，导致异常。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-42110
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-42110
请登录查看更多情报信息。
Other References for CVE-2024-42110 (4)
Same Patch Batch · Linux · 2024-07-30 · 70 CVEs total
| CVE-2024-42108 | 9.8 CRITICAL | net: rswitch: Avoid use-after-free in rswitch_poll() |
| CVE-2024-42225 | 8.3 HIGH | wifi: mt76: replace skb_put with skb_put_zero |
| CVE-2024-42120 | 7.8 HIGH | drm/amd/display: Check pipe offset before setting vblank |
| CVE-2024-42117 | 7.8 HIGH | drm/amd/display: ASSERT when failing to find index by plane/stream id |
| CVE-2024-42115 | 7.8 HIGH | jffs2: Fix potential illegal address access in jffs2_free_inode |
| CVE-2024-42112 | 7.8 HIGH | net: txgbe: free isb resources at the right time |
| CVE-2024-42111 | 7.8 HIGH | btrfs: always do the basic checks for btrfs_qgroup_inherit structure |
| CVE-2024-42109 | 7.8 HIGH | netfilter: nf_tables: unconditionally flush pending work before notifier |
| CVE-2024-42105 | 7.8 HIGH | nilfs2: fix inode number range checks |
| CVE-2024-42104 | 7.8 HIGH | nilfs2: add missing check for inode numbers on directory entries |
| CVE-2024-42103 | 7.8 HIGH | btrfs: fix adding block group to a reclaim list and the unused list during reclaim |
| CVE-2024-42162 | 7.8 HIGH | gve: Account for stopped queues when reading NIC stats |
| CVE-2024-42099 | 7.8 HIGH | s390/dasd: Fix invalid dereferencing of indirect CCW data pointer |
| CVE-2024-42132 | 7.6 HIGH | bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX |
| CVE-2024-42133 | 7.6 HIGH | Bluetooth: Ignore too large handle values in BIG |
| CVE-2024-42152 | 7.5 HIGH | nvmet: fix a possible leak when destroy a ctrl during qp establishment |
| CVE-2024-42145 | 7.5 HIGH | IB/core: Implement a limit on UMAD receive List |
| CVE-2024-42123 | 7.0 HIGH | drm/amdgpu: fix double free err_addr pointer warnings |
| CVE-2024-42224 | 7.0 HIGH | net: dsa: mv88e6xxx: Correct check for empty list |
| CVE-2024-42161 | bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD |
Showing top 20 of 70 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-68480
x86/bugs: Make Safe-RET robust against interrupt injection - CVE-2026-64604
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is - CVE-2026-64602
iio: adc: spear: Initialize completion before requesting IRQ - CVE-2026-64603
platform/x86: intel-hid: Protect ACPI notify handler against - CVE-2026-64601
ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_
Same vendor: Linux
- CVE-2026-68480
x86/bugs: Make Safe-RET robust against interrupt injection - CVE-2026-64604
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is - CVE-2026-64602
iio: adc: spear: Initialize completion before requesting IRQ - CVE-2026-64603
platform/x86: intel-hid: Protect ACPI notify handler against - CVE-2026-64601
ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_
V. Comments for CVE-2024-42110
No comments yet