Описание
In the Linux kernel, the following vulnerability has been resolved:
igc: remove napi_synchronize() in igc_down()
When an AF_XDP zero-copy application is killed abruptly, the XSK pool is
torn down but NAPI keeps polling. igc_clean_rx_irq_zc() then returns the
full budget on every poll, so napi_complete_done() never clears
NAPI_STATE_SCHED.
igc_down() calls napi_synchronize() before napi_disable(), so it spins
forever waiting for that bit and the interface never goes down. Drop the
napi_synchronize() and let napi_disable() do the job -- it sets
NAPI_STATE_DISABLE, which forces the stuck poll to complete. Reorder it
ahead of igc_set_queue_napi() so the NAPI mapping is cleared only after
polling has stopped, matching the recent igb fix b1e067240379.
A flaw was found in the Linux kernel's igc network driver. When an application using AF_XDP, a high-performance network data path, is abruptly terminated, a synchronization issue can occur. This prevents the network interface from properly shutting down. A local attacker could exploit this to cause a Denial of Service (DoS) by making the system unresponsive.
Отчет
A LOW impact local denial of service flaw was found in the Linux kernel's igc network driver as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. When an AF_XDP zero-copy application is killed abruptly, the XSK pool is torn down while NAPI keeps polling, so igc_clean_rx_irq_zc() returns its full budget on every poll and napi_complete_done() never clears NAPI_STATE_SCHED. Because igc_down() calls napi_synchronize() before napi_disable(), it spins forever waiting for that bit and the network interface never goes down. A local attacker with the privileges required to run an AF_XDP zero-copy application (CAP_NET_RAW) could exploit this by abruptly terminating such an application, leaving the igc-backed interface hung and unable to be shut down cleanly, causing a local denial of service. There is no impact on confidentiality or integrity, and the issue is not network-reachable. Red Hat Enterprise Linux 8 (from 8.6 onward), 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS are affected because they contain the igc AF_XDP zero-copy receive support; Red Hat Enterprise Linux 6, 7, and 8.4 are not affected because the vulnerable code is not present. Although the Red Hat CVSS:3.1 base score is 5.5 (Moderate), Red Hat rates the overall impact as LOW because exploitation requires local privileged access and the consequence is limited to the availability of a single network interface. Fixes for the affected streams are currently deferred to a future release given the low impact; the residual risk is a local denial of service confined to affected igc interfaces.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: igc: remove napi_synchronize() in igc_down() When an AF_XDP zero-copy application is killed abruptly, the XSK pool is torn down but NAPI keeps polling. igc_clean_rx_irq_zc() then returns the full budget on every poll, so napi_complete_done() never clears NAPI_STATE_SCHED. igc_down() calls napi_synchronize() before napi_disable(), so it spins forever waiting for that bit and the interface never goes down. Drop the napi_synchronize() and let napi_disable() do the job -- it sets NAPI_STATE_DISABLE, which forces the stuck poll to complete. Reorder it ahead of igc_set_queue_napi() so the NAPI mapping is cleared only after polling has stopped, matching the recent igb fix b1e067240379.
In the Linux kernel, the following vulnerability has been resolved: igc: remove napi_synchronize() in igc_down() When an AF_XDP zero-copy application is killed abruptly, the XSK pool is torn down but NAPI keeps polling. igc_clean_rx_irq_zc() then returns the full budget on every poll, so napi_complete_done() never clears NAPI_STATE_SCHED. igc_down() calls napi_synchronize() before napi_disable(), so it spins forever waiting for that bit and the interface never goes down. Drop the napi_synchronize() and let napi_disable() do the job -- it sets NAPI_STATE_DISABLE, which forces the stuck poll to complete. Reorder it ahead of igc_set_queue_napi() so the NAPI mapping is cleared only after polling has stopped, matching the recent igb fix b1e067240379.
In the Linux kernel, the following vulnerability has been resolved: i ...
In the Linux kernel, the following vulnerability has been resolved: igc: remove napi_synchronize() in igc_down() When an AF_XDP zero-copy application is killed abruptly, the XSK pool is torn down but NAPI keeps polling. igc_clean_rx_irq_zc() then returns the full budget on every poll, so napi_complete_done() never clears NAPI_STATE_SCHED. igc_down() calls napi_synchronize() before napi_disable(), so it spins forever waiting for that bit and the interface never goes down. Drop the napi_synchronize() and let napi_disable() do the job -- it sets NAPI_STATE_DISABLE, which forces the stuck poll to complete. Reorder it ahead of igc_set_queue_napi() so the NAPI mapping is cleared only after polling has stopped, matching the recent igb fix b1e067240379.
EPSS
5.5 Medium
CVSS3