Intel ice driver UAF in dynamic port cleanup (drivers/net/ethernet/intel/ice/devlink.c)

Vulnerability Overview This vulnerability arises because the driver uses to erase the VLAN entry for a dynamic port during the dynamic port cleanup process. However, it releases the before reading it for erasure, resulting in a use-after-free issue. Scope of Impact File: Function: Remediation The fix involves reversing the allocation order: erase the array entry before releasing the . POC Code or Exploit Code The page does not contain specific POC code or exploit code, but provides the diff content of the fix patch: ```diff diff --git a/drivers/net/ethernet/intel/ice/devlink.c b/drivers/net/ethernet/intel/ice/devlink.c index 40935047e24a..306d24690727 100644 --- a/drivers/net/ethernet/intel/ice/devlink.c +++ b/drivers/net/ethernet/intel/ice/devlink.c @@ -530,8 +530,8 @@ static void ice_devlink_dynamic_port(struct ice_dynamic_port *dyn_port) { u16 eswitch_devs; if (eswitch_devs) ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitc

Goal Reached Thanks to every supporter — we hit 100%!

Intel ice driver UAF in dynamic port cleanup (drivers/net/ethernet/intel/ice/devlink.c)

More from this source