CVE-2024-36887 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: e1000e: change usleep_range to udelay in PHY mdic access This is a partial revert of commit 6dbdd4de0362 ("e1000e: Workaround for sporadic MDI error on Meteor Lake systems"). The referenced commit used usleep_range inside the PHY access routines, which are sometimes called from an atomic context. This can lead to a kernel panic in some scenarios, such as cable disconnection and reconnection on vPro systems. Solve this by changing the usleep_range calls back to udelay.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/387f295cb2150ed164905b648d76dfcbd3621778
https://git.kernel.org/stable/c/950d5226cd6bb83ba720961a8d4d5cf79e6afd57
https://git.kernel.org/stable/c/f8a139656c95db893a543159873c57a470d7376d
https://lore.kernel.org/linux-cve-announce/2024053033-CVE-2024-36887-6a66@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-36887
https://www.cve.org/CVERecord?id=CVE-2024-36887

History

No history.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-30T15:28:55.630Z

Updated: 2024-11-05T09:27:30.579Z

Reserved: 2024-05-30T15:25:07.065Z

Link: CVE-2024-36887

Vulnrichment

Updated: 2024-08-02T03:43:50.019Z

NVD

Status : Awaiting Analysis

Published: 2024-05-30T16:15:12.243

Modified: 2024-05-30T18:18:58.870

Link: CVE-2024-36887

Redhat

Severity : Low

Publid Date: 2024-05-30T00:00:00Z

Links: CVE-2024-36887 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-36887", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-30T15:25:07.065Z", "datePublished": "2024-05-30T15:28:55.630Z", "dateUpdated": "2024-11-05T09:27:30.579Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-05T09:27:30.579Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ne1000e: change usleep_range to udelay in PHY mdic access\n\nThis is a partial revert of commit 6dbdd4de0362 (\"e1000e: Workaround\nfor sporadic MDI error on Meteor Lake systems\"). The referenced commit\nused usleep_range inside the PHY access routines, which are sometimes\ncalled from an atomic context. This can lead to a kernel panic in some\nscenarios, such as cable disconnection and reconnection on vPro systems.\n\nSolve this by changing the usleep_range calls back to udelay."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/e1000e/phy.c"], "versions": [{"version": "1d16cd91cd31", "lessThan": "f8a139656c95", "status": "affected", "versionType": "git"}, {"version": "0a4e3c2d976a", "lessThan": "950d5226cd6b", "status": "affected", "versionType": "git"}, {"version": "6dbdd4de0362", "lessThan": "387f295cb215", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/e1000e/phy.c"], "versions": [{"version": "6.6.26", "lessThan": "6.6.31", "status": "affected", "versionType": "semver"}, {"version": "6.8.5", "lessThan": "6.8.10", "status": "affected", "versionType": "semver"}]}], "references": [{"url": "https://git.kernel.org/stable/c/f8a139656c95db893a543159873c57a470d7376d"}, {"url": "https://git.kernel.org/stable/c/950d5226cd6bb83ba720961a8d4d5cf79e6afd57"}, {"url": "https://git.kernel.org/stable/c/387f295cb2150ed164905b648d76dfcbd3621778"}], "title": "e1000e: change usleep_range to udelay in PHY mdic access", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36887", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-03T17:21:16.500731Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:47:39.644Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.019Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/f8a139656c95db893a543159873c57a470d7376d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/950d5226cd6bb83ba720961a8d4d5cf79e6afd57", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/387f295cb2150ed164905b648d76dfcbd3621778", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/f8a139656c95db893a543159873c57a470d7376d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/950d5226cd6bb83ba720961a8d4d5cf79e6afd57", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/387f295cb2150ed164905b648d76dfcbd3621778", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.019Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36887", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-03T17:21:16.500731Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-03T17:21:28.449Z"}}], "cna": {"title": "e1000e: change usleep_range to udelay in PHY mdic access", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1d16cd91cd31", "lessThan": "f8a139656c95", "versionType": "git"}, {"status": "affected", "version": "0a4e3c2d976a", "lessThan": "950d5226cd6b", "versionType": "git"}, {"status": "affected", "version": "6dbdd4de0362", "lessThan": "387f295cb215", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/intel/e1000e/phy.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.6.26", "lessThan": "6.6.31", "versionType": "custom"}, {"status": "affected", "version": "6.8.5", "lessThan": "6.8.10", "versionType": "custom"}], "programFiles": ["drivers/net/ethernet/intel/e1000e/phy.c"], "defaultStatus": "unaffected"}], "references": [{"url": "https://git.kernel.org/stable/c/f8a139656c95db893a543159873c57a470d7376d"}, {"url": "https://git.kernel.org/stable/c/950d5226cd6bb83ba720961a8d4d5cf79e6afd57"}, {"url": "https://git.kernel.org/stable/c/387f295cb2150ed164905b648d76dfcbd3621778"}], "x_generator": {"engine": "bippy-a5840b7849dd"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ne1000e: change usleep_range to udelay in PHY mdic access\n\nThis is a partial revert of commit 6dbdd4de0362 (\"e1000e: Workaround\nfor sporadic MDI error on Meteor Lake systems\"). The referenced commit\nused usleep_range inside the PHY access routines, which are sometimes\ncalled from an atomic context. This can lead to a kernel panic in some\nscenarios, such as cable disconnection and reconnection on vPro systems.\n\nSolve this by changing the usleep_range calls back to udelay."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-30T15:28:55.630Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36887", "state": "PUBLISHED", "dateUpdated": "2024-08-02T03:43:50.019Z", "dateReserved": "2024-05-30T15:25:07.065Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-30T15:28:55.630Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: e1000e: change usleep_range to udelay in PHY mdic access", "id": "2284576", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2284576"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ne1000e: change usleep_range to udelay in PHY mdic access\nThis is a partial revert of commit 6dbdd4de0362 (\"e1000e: Workaround\nfor sporadic MDI error on Meteor Lake systems\"). The referenced commit\nused usleep_range inside the PHY access routines, which are sometimes\ncalled from an atomic context. This can lead to a kernel panic in some\nscenarios, such as cable disconnection and reconnection on vPro systems.\nSolve this by changing the usleep_range calls back to udelay."], "name": "CVE-2024-36887", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-36887\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-36887\nhttps://lore.kernel.org/linux-cve-announce/2024053033-CVE-2024-36887-6a66@gregkh/T"], "threat_severity": "Low", "upstream_fix": "kernel 6.6.31, kernel 6.8.10"}