In the Linux kernel, the following vulnerability has been resolved: ixgbevf: add missing negotiate_features op to Hyper-V ops table Commit a7075f501bd3 ("ixgbevf: fix mailbox API compatibility by negotiating supported features") added the .negotiate_features callback to ixgbe_mac_operations and populated it in ixgbevf_mac_ops, but forgot to add it to ixgbevf_hv_mac_ops. This leaves the function pointer NULL on Hyper-V VMs. During probe, ixgbevf_negotiate_api() calls ixgbevf_set_features(), which unconditionally dereferences hw->mac.ops.negotiate_features(). On Hyper-V this results in a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine [...] Workqueue: events work_for_cpu_fn RIP: 0010:0x0 [...] Call Trace: ixgbevf_negotiate_api+0x66/0x160 [ixgbevf] ixgbevf_sw_init+0xe4/0x1f0 [ixgbevf] ixgbevf_probe+0x20f/0x4a0 [ixgbevf] local_pci_probe+0x50/0xa0 work_for_cpu_fn+0x1a/0x30 [...] Add ixgbevf_hv_negotiate_features_vf() that returns -EOPNOTSUPP and wire it into ixgbevf_hv_mac_ops. The caller already handles -EOPNOTSUPP gracefully.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-476
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd340a923c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2dbe0fe80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd368d70600> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2dbe0c100> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd38461c600> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2a159e9c0> | Operating System |
| linux | linux_kernel | 6.18 | <built-in method update of dict object at 0x7fd36960cdc0> | Operating System |
| linux | linux_kernel | 6.18 | <built-in method update of dict object at 0x7fd36a717580> | Operating System |
| linux | linux_kernel | 6.18 | <built-in method update of dict object at 0x7fd38672ce40> | Operating System |
| linux | linux_kernel | 6.18 | <built-in method update of dict object at 0x7fd340a912c0> | Operating System |
| linux | linux_kernel | 6.18 | <built-in method update of dict object at 0x7fd2dbe0fd40> | Operating System |
| linux | linux_kernel | 6.18 | <built-in method update of dict object at 0x7fd36b3f38c0> | Operating System |
| linux | linux_kernel | 6.18 | <built-in method update of dict object at 0x7fd36960ee40> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd36a714d00> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd384aa27c0> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd37038e300> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd36971ec80> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd38672f640> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd5117cbf40> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd36960dd80> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.18:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.18:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.18:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.18:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.18:rc7:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* |