CVE-2024-26802

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

stmmac: Clear variable when destroying workqueue

Currently when suspending driver and stopping workqueue it is checked whether

workqueue is not NULL and if so, it is destroyed.

Function destroy_workqueue() does drain queue and does clear variable, but

it does not set workqueue variable to NULL. This can cause kernel/module

panic if code attempts to clear workqueue that was not initialized.

This scenario is possible when resuming suspended driver in stmmac_resume(),

because there is no handling for failed stmmac_hw_setup(),

which can fail and return if DMA engine has failed to initialize,

and workqueue is initialized after DMA engine.

Should DMA engine fail to initialize, resume will proceed normally,

but interface won't work and TX queue will eventually timeout,

causing 'Reset adapter' error.

This then does destroy workqueue during reset process.

And since workqueue is initialized after DMA engine and can be skipped

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References