CVE-2024-36928 (GCVE-0-2024-36928)
Vulnerability from cvelistv5
Published
2024-05-30 15:29
Modified
2026-08-05 11:32
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Fix kernel panic after setting hsuid Symptom: When the hsuid attribute is set for the first time on an IQD Layer3 device while the corresponding network interface is already UP, the kernel will try to execute a napi function pointer that is NULL. Example: --------------------------------------------------------------------------- [ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP [ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 de s_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod qdio ccwgroup pkey zcrypt [ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1 [ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR) [ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2) [ 2057.572748] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 [ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000 [ 2057.572754] 00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80 [ 2057.572756] 000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8 [ 2057.572758] 00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68 [ 2057.572762] Krnl Code:#0000000000000000: 0000 illegal >0000000000000002: 0000 illegal 0000000000000004: 0000 illegal 0000000000000006: 0000 illegal 0000000000000008: 0000 illegal 000000000000000a: 0000 illegal 000000000000000c: 0000 illegal 000000000000000e: 0000 illegal [ 2057.572800] Call Trace: [ 2057.572801] ([<00000000ec639700>] 0xec639700) [ 2057.572803] [<00000000913183e2>] net_rx_action+0x2ba/0x398 [ 2057.572809] [<0000000091515f76>] __do_softirq+0x11e/0x3a0 [ 2057.572813] [<0000000090ce160c>] do_softirq_own_stack+0x3c/0x58 [ 2057.572817] ([<0000000090d2cbd6>] do_softirq.part.1+0x56/0x60) [ 2057.572822] [<0000000090d2cc60>] __local_bh_enable_ip+0x80/0x98 [ 2057.572825] [<0000000091314706>] __dev_queue_xmit+0x2be/0xd70 [ 2057.572827] [<000003ff803dd6d6>] afiucv_hs_send+0x24e/0x300 [af_iucv] [ 2057.572830] [<000003ff803dd88a>] iucv_send_ctrl+0x102/0x138 [af_iucv] [ 2057.572833] [<000003ff803de72a>] iucv_sock_connect+0x37a/0x468 [af_iucv] [ 2057.572835] [<00000000912e7e90>] __sys_connect+0xa0/0xd8 [ 2057.572839] [<00000000912e9580>] sys_socketcall+0x228/0x348 [ 2057.572841] [<0000000091514e1a>] system_call+0x2a6/0x2c8 [ 2057.572843] Last Breaking-Event-Address: [ 2057.572844] [<0000000091317e44>] __napi_poll+0x4c/0x1d8 [ 2057.572846] [ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt ------------------------------------------------------------------------------------------- Analysis: There is one napi structure per out_q: card->qdio.out_qs[i].napi The napi.poll functions are set during qeth_open(). Since commit 1cfef80d4c2b ("s390/qeth: Don't call dev_close/dev_open (DOWN/UP)") qeth_set_offline()/qeth_set_online() no longer call dev_close()/ dev_open(). So if qeth_free_qdio_queues() cleared card->qdio.out_qs[i].napi.poll while the network interface was UP and the card was offline, they are not set again. Reproduction: chzdev -e $devno layer2=0 ip link set dev $network_interface up echo 0 > /sys/bus/ccw ---truncated---
References
Impacted products
Vendor Product Version
Linux Linux Version: 64e3affee2881bb22df7ce45dd1f1fd7990e382b
Version: 86818409f989fee29c38528ed8fb085655603356
Version: 1cfef80d4c2b2c599189f36f36320b205d9447d9
Version: 1cfef80d4c2b2c599189f36f36320b205d9447d9
Version: 1cfef80d4c2b2c599189f36f36320b205d9447d9
Version: c33d5a5c5b2c79326190885040f1643793c67b29
Version: 29d6fe395087710280f8e11d4ae79569c4cb14b7
Version: 5.15.126   ≤
Version: 6.1.45   ≤
Version: 5.10.190   ≤
Version: 6.4.10   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 4.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-36928",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-31T18:29:03.569739Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T15:55:40.336Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.063Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8792b557eb50b986f2496156d486d0c7c85a1524"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/10cb803aff3b11fe0bd5f274fc1c231a43e88df6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e28dd1e1bf3ebb52cdb877fb359e8978a51576e3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/eae0aec245712c52a3ce9c05575b541a9eef5282"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8a2e4d37afb8500b276e5ee903dee06f50ab0494"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/net/qeth_core_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8792b557eb50b986f2496156d486d0c7c85a1524",
              "status": "affected",
              "version": "64e3affee2881bb22df7ce45dd1f1fd7990e382b",
              "versionType": "git"
            },
            {
              "lessThan": "10cb803aff3b11fe0bd5f274fc1c231a43e88df6",
              "status": "affected",
              "version": "86818409f989fee29c38528ed8fb085655603356",
              "versionType": "git"
            },
            {
              "lessThan": "e28dd1e1bf3ebb52cdb877fb359e8978a51576e3",
              "status": "affected",
              "version": "1cfef80d4c2b2c599189f36f36320b205d9447d9",
              "versionType": "git"
            },
            {
              "lessThan": "eae0aec245712c52a3ce9c05575b541a9eef5282",
              "status": "affected",
              "version": "1cfef80d4c2b2c599189f36f36320b205d9447d9",
              "versionType": "git"
            },
            {
              "lessThan": "8a2e4d37afb8500b276e5ee903dee06f50ab0494",
              "status": "affected",
              "version": "1cfef80d4c2b2c599189f36f36320b205d9447d9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c33d5a5c5b2c79326190885040f1643793c67b29",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "29d6fe395087710280f8e11d4ae79569c4cb14b7",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.159",
              "status": "affected",
              "version": "5.15.126",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.91",
              "status": "affected",
              "version": "6.1.45",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.190",
              "versionType": "semver"
            },
            {
              "lessThan": "6.5",
              "status": "affected",
              "version": "6.4.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/net/qeth_core_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.159",
                  "versionStartIncluding": "5.15.126",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.91",
                  "versionStartIncluding": "6.1.45",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.190",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.4.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/qeth: Fix kernel panic after setting hsuid\n\nSymptom:\nWhen the hsuid attribute is set for the first time on an IQD Layer3\ndevice while the corresponding network interface is already UP,\nthe kernel will try to execute a napi function pointer that is NULL.\n\nExample:\n---------------------------------------------------------------------------\n[ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP\n[ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6\nnft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 de\ns_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod\n qdio ccwgroup pkey zcrypt\n[ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1\n[ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR)\n[ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2)\n[ 2057.572748]            R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3\n[ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000\n[ 2057.572754]            00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80\n[ 2057.572756]            000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8\n[ 2057.572758]            00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68\n[ 2057.572762] Krnl Code:#0000000000000000: 0000                illegal\n                         \u003e0000000000000002: 0000                illegal\n                          0000000000000004: 0000                illegal\n                          0000000000000006: 0000                illegal\n                          0000000000000008: 0000                illegal\n                          000000000000000a: 0000                illegal\n                          000000000000000c: 0000                illegal\n                          000000000000000e: 0000                illegal\n[ 2057.572800] Call Trace:\n[ 2057.572801] ([\u003c00000000ec639700\u003e] 0xec639700)\n[ 2057.572803]  [\u003c00000000913183e2\u003e] net_rx_action+0x2ba/0x398\n[ 2057.572809]  [\u003c0000000091515f76\u003e] __do_softirq+0x11e/0x3a0\n[ 2057.572813]  [\u003c0000000090ce160c\u003e] do_softirq_own_stack+0x3c/0x58\n[ 2057.572817] ([\u003c0000000090d2cbd6\u003e] do_softirq.part.1+0x56/0x60)\n[ 2057.572822]  [\u003c0000000090d2cc60\u003e] __local_bh_enable_ip+0x80/0x98\n[ 2057.572825]  [\u003c0000000091314706\u003e] __dev_queue_xmit+0x2be/0xd70\n[ 2057.572827]  [\u003c000003ff803dd6d6\u003e] afiucv_hs_send+0x24e/0x300 [af_iucv]\n[ 2057.572830]  [\u003c000003ff803dd88a\u003e] iucv_send_ctrl+0x102/0x138 [af_iucv]\n[ 2057.572833]  [\u003c000003ff803de72a\u003e] iucv_sock_connect+0x37a/0x468 [af_iucv]\n[ 2057.572835]  [\u003c00000000912e7e90\u003e] __sys_connect+0xa0/0xd8\n[ 2057.572839]  [\u003c00000000912e9580\u003e] sys_socketcall+0x228/0x348\n[ 2057.572841]  [\u003c0000000091514e1a\u003e] system_call+0x2a6/0x2c8\n[ 2057.572843] Last Breaking-Event-Address:\n[ 2057.572844]  [\u003c0000000091317e44\u003e] __napi_poll+0x4c/0x1d8\n[ 2057.572846]\n[ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt\n-------------------------------------------------------------------------------------------\n\nAnalysis:\nThere is one napi structure per out_q: card-\u003eqdio.out_qs[i].napi\nThe napi.poll functions are set during qeth_open().\n\nSince\ncommit 1cfef80d4c2b (\"s390/qeth: Don\u0027t call dev_close/dev_open (DOWN/UP)\")\nqeth_set_offline()/qeth_set_online() no longer call dev_close()/\ndev_open(). So if qeth_free_qdio_queues() cleared\ncard-\u003eqdio.out_qs[i].napi.poll while the network interface was UP and the\ncard was offline, they are not set again.\n\nReproduction:\nchzdev -e $devno layer2=0\nip link set dev $network_interface up\necho 0 \u003e /sys/bus/ccw\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable state is created through a local sysfs write (`/sys/bus/ccwgroup/devices/0.0.$devno/hsuid`) and the panic is then reached through local socket activity on the s390 IQD interface \u2014 the reproducer uses an AF_IUCV `connect()` syscall, and any local packet transmission on the netdev arms the stale/NULL TX NAPI.\nAC:L - No race and no memory-layout precondition \u2014 once the device has been through the offline/hsuid/online sequence, the very next `napi_schedule()` deterministically branches to a NULL `poll` pointer, so a single `connect()` or any outbound packet reliably panics the machine.\nPR:L - The crash is triggered by a completely unprivileged local user: the reported panic came from a non-root `stress_client` doing `af_iucv connect()`, and the dangling `napi_struct` entries left in `dev-\u003enapi_list` are also reachable via the unprivileged netdev generic-netlink NAPI dump, which carries no `GENL_ADMIN_PERM`.\nUI:N - No victim action is required at exploitation time \u2014 the hsuid configuration is a pre-existing, documented administrative state, and once the device is in it the attacker triggers the fault entirely on their own through normal socket calls.\nS:U - The freed queue objects, the NAPI list corruption and the resulting fault are all confined to the kernel of the same s390 LPAR/guest; no hypervisor, IOMMU or VM boundary is crossed.\nC:H - `qeth_free_qdio_queues()` frees the `qeth_qdio_out_q` allocations while their embedded `napi_struct` remain linked in `dev-\u003enapi_list` and the NAPI hash, so subsequent traversals (unprivileged `netdev-genl` NAPI dump, `free_netdev()`, `netif_set_threaded()`, netpoll) read freed heap memory that an attacker can spray, yielding kernel memory disclosure.\nI:H - The use-after-free leaves a stale `napi_struct` whose `-\u003epoll` function pointer and list linkage live in reallocatable slab memory; controlling that reallocation gives a hijacked indirect call and `list_del()` writes into attacker-influenced memory, i.e. a control-flow/arbitrary-write primitive.\nA:H - The documented result is an immediate `illegal operation` in softirq context ending in \"Kernel panic - not syncing: Fatal exception in interrupt\", a full system crash of the s390 LPAR that any local user can provoke on demand."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:07.195Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8792b557eb50b986f2496156d486d0c7c85a1524"
        },
        {
          "url": "https://git.kernel.org/stable/c/10cb803aff3b11fe0bd5f274fc1c231a43e88df6"
        },
        {
          "url": "https://git.kernel.org/stable/c/e28dd1e1bf3ebb52cdb877fb359e8978a51576e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/eae0aec245712c52a3ce9c05575b541a9eef5282"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a2e4d37afb8500b276e5ee903dee06f50ab0494"
        }
      ],
      "title": "s390/qeth: Fix kernel panic after setting hsuid",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36928",
    "datePublished": "2024-05-30T15:29:20.854Z",
    "dateReserved": "2024-05-30T15:25:07.069Z",
    "dateUpdated": "2026-08-05T11:32:07.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8792b557eb50b986f2496156d486d0c7c85a1524\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/10cb803aff3b11fe0bd5f274fc1c231a43e88df6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e28dd1e1bf3ebb52cdb877fb359e8978a51576e3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/eae0aec245712c52a3ce9c05575b541a9eef5282\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8a2e4d37afb8500b276e5ee903dee06f50ab0494\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:43:50.063Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36928\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-31T18:29:03.569739Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-31T18:29:07.604Z\"}}], \"cna\": {\"title\": \"s390/qeth: Fix kernel panic after setting hsuid\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"64e3affee2881bb22df7ce45dd1f1fd7990e382b\", \"lessThan\": \"8792b557eb50b986f2496156d486d0c7c85a1524\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"86818409f989fee29c38528ed8fb085655603356\", \"lessThan\": \"10cb803aff3b11fe0bd5f274fc1c231a43e88df6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cfef80d4c2b2c599189f36f36320b205d9447d9\", \"lessThan\": \"e28dd1e1bf3ebb52cdb877fb359e8978a51576e3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cfef80d4c2b2c599189f36f36320b205d9447d9\", \"lessThan\": \"eae0aec245712c52a3ce9c05575b541a9eef5282\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cfef80d4c2b2c599189f36f36320b205d9447d9\", \"lessThan\": \"8a2e4d37afb8500b276e5ee903dee06f50ab0494\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c33d5a5c5b2c79326190885040f1643793c67b29\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"29d6fe395087710280f8e11d4ae79569c4cb14b7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.15.126\", \"lessThan\": \"5.15.159\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.1.45\", \"lessThan\": \"6.1.91\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.10.190\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.4.10\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/s390/net/qeth_core_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.159\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.91\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.31\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/s390/net/qeth_core_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8792b557eb50b986f2496156d486d0c7c85a1524\"}, {\"url\": \"https://git.kernel.org/stable/c/10cb803aff3b11fe0bd5f274fc1c231a43e88df6\"}, {\"url\": \"https://git.kernel.org/stable/c/e28dd1e1bf3ebb52cdb877fb359e8978a51576e3\"}, {\"url\": \"https://git.kernel.org/stable/c/eae0aec245712c52a3ce9c05575b541a9eef5282\"}, {\"url\": \"https://git.kernel.org/stable/c/8a2e4d37afb8500b276e5ee903dee06f50ab0494\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ns390/qeth: Fix kernel panic after setting hsuid\\n\\nSymptom:\\nWhen the hsuid attribute is set for the first time on an IQD Layer3\\ndevice while the corresponding network interface is already UP,\\nthe kernel will try to execute a napi function pointer that is NULL.\\n\\nExample:\\n---------------------------------------------------------------------------\\n[ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP\\n[ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6\\nnft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 de\\ns_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod\\n qdio ccwgroup pkey zcrypt\\n[ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1\\n[ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR)\\n[ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2)\\n[ 2057.572748]            R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3\\n[ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000\\n[ 2057.572754]            00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80\\n[ 2057.572756]            000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8\\n[ 2057.572758]            00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68\\n[ 2057.572762] Krnl Code:#0000000000000000: 0000                illegal\\n                         \u003e0000000000000002: 0000                illegal\\n                          0000000000000004: 0000                illegal\\n                          0000000000000006: 0000                illegal\\n                          0000000000000008: 0000                illegal\\n                          000000000000000a: 0000                illegal\\n                          000000000000000c: 0000                illegal\\n                          000000000000000e: 0000                illegal\\n[ 2057.572800] Call Trace:\\n[ 2057.572801] ([\u003c00000000ec639700\u003e] 0xec639700)\\n[ 2057.572803]  [\u003c00000000913183e2\u003e] net_rx_action+0x2ba/0x398\\n[ 2057.572809]  [\u003c0000000091515f76\u003e] __do_softirq+0x11e/0x3a0\\n[ 2057.572813]  [\u003c0000000090ce160c\u003e] do_softirq_own_stack+0x3c/0x58\\n[ 2057.572817] ([\u003c0000000090d2cbd6\u003e] do_softirq.part.1+0x56/0x60)\\n[ 2057.572822]  [\u003c0000000090d2cc60\u003e] __local_bh_enable_ip+0x80/0x98\\n[ 2057.572825]  [\u003c0000000091314706\u003e] __dev_queue_xmit+0x2be/0xd70\\n[ 2057.572827]  [\u003c000003ff803dd6d6\u003e] afiucv_hs_send+0x24e/0x300 [af_iucv]\\n[ 2057.572830]  [\u003c000003ff803dd88a\u003e] iucv_send_ctrl+0x102/0x138 [af_iucv]\\n[ 2057.572833]  [\u003c000003ff803de72a\u003e] iucv_sock_connect+0x37a/0x468 [af_iucv]\\n[ 2057.572835]  [\u003c00000000912e7e90\u003e] __sys_connect+0xa0/0xd8\\n[ 2057.572839]  [\u003c00000000912e9580\u003e] sys_socketcall+0x228/0x348\\n[ 2057.572841]  [\u003c0000000091514e1a\u003e] system_call+0x2a6/0x2c8\\n[ 2057.572843] Last Breaking-Event-Address:\\n[ 2057.572844]  [\u003c0000000091317e44\u003e] __napi_poll+0x4c/0x1d8\\n[ 2057.572846]\\n[ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt\\n-------------------------------------------------------------------------------------------\\n\\nAnalysis:\\nThere is one napi structure per out_q: card-\u003eqdio.out_qs[i].napi\\nThe napi.poll functions are set during qeth_open().\\n\\nSince\\ncommit 1cfef80d4c2b (\\\"s390/qeth: Don\u0027t call dev_close/dev_open (DOWN/UP)\\\")\\nqeth_set_offline()/qeth_set_online() no longer call dev_close()/\\ndev_open(). So if qeth_free_qdio_queues() cleared\\ncard-\u003eqdio.out_qs[i].napi.poll while the network interface was UP and the\\ncard was offline, they are not set again.\\n\\nReproduction:\\nchzdev -e $devno layer2=0\\nip link set dev $network_interface up\\necho 0 \u003e /sys/bus/ccw\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.159\", \"versionStartIncluding\": \"5.15.126\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.91\", \"versionStartIncluding\": \"6.1.45\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.31\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.10\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.10.190\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.4.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:47:33.232Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36928\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:47:33.232Z\", \"dateReserved\": \"2024-05-30T15:25:07.069Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-30T15:29:20.854Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.