CVE-2024-36003

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ice: fix LAG and VF lock dependency in ice_reset_vf()

9f74a3dfcf83 ("ice: Fix VF Reset paths when interface in a failed over

aggregate"), the ice driver has acquired the LAG mutex in ice_reset_vf().

The commit placed this lock acquisition just prior to the acquisition of

the VF configuration lock.

If ice_reset_vf() acquires the configuration lock via the ICE_VF_RESET_LOCK

flag, this could deadlock with ice_vc_cfg_qs_msg() because it always

acquires the locks in the order of the VF configuration lock and then the

LAG mutex.

Lockdep reports this violation almost immediately on creating and then

removing 2 VF:

======================================================

WARNING: possible circular locking dependency detected

6.8.0-rc6 #54 Tainted: G W O

------------------------------------------------------

kworker/60:3/6771 is trying to acquire lock:

ff40d43e099380a0 (&vf->cfg_lock){+.+.}-{3:3}, at: ice_reset_vf+0x

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References