{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-42110", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-29T15:50:41.176Z", "datePublished": "2024-07-30T07:46:04.892Z", "dateUpdated": "2026-08-05T11:35:42.204Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:35:42.204Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()\n\nThe following is emitted when using idxd (DSA) dmanegine as the data\nmover for ntb_transport that ntb_netdev uses.\n\n[74412.546922] BUG: using smp_processor_id() in preemptible [00000000] code: irq/52-idxd-por/14526\n[74412.556784] caller is netif_rx_internal+0x42/0x130\n[74412.562282] CPU: 6 PID: 14526 Comm: irq/52-idxd-por Not tainted 6.9.5 #5\n[74412.569870] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.E9I.1752.P05.2402080856 02/08/2024\n[74412.581699] Call Trace:\n[74412.584514] \n[74412.586933] dump_stack_lvl+0x55/0x70\n[74412.591129] check_preemption_disabled+0xc8/0xf0\n[74412.596374] netif_rx_internal+0x42/0x130\n[74412.600957] __netif_rx+0x20/0xd0\n[74412.604743] ntb_netdev_rx_handler+0x66/0x150 [ntb_netdev]\n[74412.610985] ntb_complete_rxc+0xed/0x140 [ntb_transport]\n[74412.617010] ntb_rx_copy_callback+0x53/0x80 [ntb_transport]\n[74412.623332] idxd_dma_complete_txd+0xe3/0x160 [idxd]\n[74412.628963] idxd_wq_thread+0x1a6/0x2b0 [idxd]\n[74412.634046] irq_thread_fn+0x21/0x60\n[74412.638134] ? irq_thread+0xa8/0x290\n[74412.642218] irq_thread+0x1a0/0x290\n[74412.646212] ? __pfx_irq_thread_fn+0x10/0x10\n[74412.651071] ? __pfx_irq_thread_dtor+0x10/0x10\n[74412.656117] ? __pfx_irq_thread+0x10/0x10\n[74412.660686] kthread+0x100/0x130\n[74412.664384] ? __pfx_kthread+0x10/0x10\n[74412.668639] ret_from_fork+0x31/0x50\n[74412.672716] ? __pfx_kthread+0x10/0x10\n[74412.676978] ret_from_fork_asm+0x1a/0x30\n[74412.681457] \n\nThe cause is due to the idxd driver interrupt completion handler uses\nthreaded interrupt and the threaded handler is not hard or soft interrupt\ncontext. However __netif_rx() can only be called from interrupt context.\nChange the call to netif_rx() in order to allow completion via normal\ncontext for dmaengine drivers that utilize threaded irq handling.\n\nWhile the following commit changed from netif_rx() to __netif_rx(),\nbaebdf48c360 (\"net: dev: Makes sure netif_rx() can be invoked in any context.\"),\nthe change should've been a noop instead. However, the code precedes this\nfix should've been using netif_rx_ni() or netif_rx_any_context()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable code is a network receive handler bound to the kernel network stack; it runs on every frame arriving on the ntb_netdev Ethernet interface, with the payload supplied by a remote peer over the NTB interconnect. In the dual-controller storage and cluster deployments NTB exists for, that interconnect carries routed/bridged IP traffic, so packets originating more than one hop away reach `ntb_netdev_rx_handler()` and no local access to the target is needed.\nAC:L - Scored in the vulnerable configuration (`ntb_transport use_dma=1` with a threaded-completion dmaengine such as idxd/DSA, exactly what the report documents), every frame at or above the default `copy_bytes=1024` threshold takes `ntb_async_rx()` and completes in the preemptible `idxd_wq_thread` IRQ kthread, so ordinary MTU-sized traffic hits `__netif_rx()` in preemptible context 100% of the time. There is no race to win, no timing window, and no memory-layout precondition — the attacker sets the rate and the frame size.\nPR:N - The path is raw Ethernet frame reception — `eth_type_trans()` and `__netif_rx()` run before any protocol, socket, or application-layer authentication, and nothing on the path calls `capable()` or checks credentials. The attacker needs no account, session, or key on the target.\nUI:N - The attacker generates the frames and the NTB doorbell, tasklet, DMA submission, and idxd completion thread all run autonomously as part of normal interface operation. No administrator or second user has to log in, mount, open, or configure anything.\nS:U - The preemption violation, the deferred softirq, and any resulting backlog corruption or panic all occur inside the kernel that owns the ntb_netdev interface and the per-CPU `softnet_data`; no VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:N - There is no out-of-bounds read, use-after-free, or uninitialized-memory disclosure — `enqueue_to_backlog()` is passed a valid `struct softnet_data` and the skb is a properly sized, driver-allocated buffer. The only artifact is the rate-limited `BUG:`/`dump_stack()` in dmesg, which prints symbol+offset rather than raw addresses and is not observable by the packet-sending attacker at all.\nI:N - On any realistic affected system `CONFIG_RPS` is set (`default y`, disabled only when `SMP=n`, which removes the race, or `SYSFS=n`, absent on the x86 servers NTB ships on), so `backlog_lock_irq_save()` takes `spin_lock_irqsave(&sd->input_pkt_queue.lock)` and every cross-CPU backlog access stays properly serialized. Packets themselves are delivered unmodified — merely late — and no attacker-controlled data lands in unintended kernel memory.\nA:H - `__netif_rx()`'s `lockdep_assert_once(hardirq_count() | softirq_count())` is a `WARN_ON_ONCE`, so on `CONFIG_PROVE_LOCKING` kernels booted with `panic_on_warn=1` — standard for fail-fast storage appliances and CI fleets — the first frame panics the host outright. Even without that, `napi_schedule_rps()` only sets the `NET_RX_SOFTIRQ` pending bit and nothing drains it (the fix's `local_bh_enable()` is precisely what restores that), so under sustained peer traffic the backlog exceeds `netdev_max_backlog` and packets are discarded in `cpu_backlog_drop`, stalling the node interconnect; and on SMP builds where `CONFIG_RPS` is off, the bare `local_irq_save()` leaves a migrated thread corrupting a remote CPU's `input_pkt_queue` and `backlog.state`, producing skb list corruption and an oops." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ntb_netdev.c" ], "versions": [ { "version": "548c237c0a9972df5d1afaca38aa733ee577128d", "lessThan": "4b3b6c7efee69f077b86ef7f088fb96768e46e1f", "status": "affected", "versionType": "git" }, { "version": "548c237c0a9972df5d1afaca38aa733ee577128d", "lessThan": "e3af5b14e7632bf12058533d69055393e2d126c9", "status": "affected", "versionType": "git" }, { "version": "548c237c0a9972df5d1afaca38aa733ee577128d", "lessThan": "858ae09f03677a4ab907a15516893bc2cc79d4c3", "status": "affected", "versionType": "git" }, { "version": "548c237c0a9972df5d1afaca38aa733ee577128d", "lessThan": "e15a5d821e5192a3769d846079bc9aa380139baf", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ntb_netdev.c" ], "versions": [ { "version": "3.9", "status": "affected" }, { "version": "0", "lessThan": "3.9", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.98", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.39", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.9", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.1.98" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.6.39" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.9.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/4b3b6c7efee69f077b86ef7f088fb96768e46e1f" }, { "url": "https://git.kernel.org/stable/c/e3af5b14e7632bf12058533d69055393e2d126c9" }, { "url": "https://git.kernel.org/stable/c/858ae09f03677a4ab907a15516893bc2cc79d4c3" }, { "url": "https://git.kernel.org/stable/c/e15a5d821e5192a3769d846079bc9aa380139baf" } ], "title": "net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/4b3b6c7efee69f077b86ef7f088fb96768e46e1f", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/e3af5b14e7632bf12058533d69055393e2d126c9", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/858ae09f03677a4ab907a15516893bc2cc79d4c3", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/e15a5d821e5192a3769d846079bc9aa380139baf", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:01:45.573Z" } }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-42110", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:17:32.906742Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:06.779Z" } } ] } }