CVE-2024-50040

igb: Do not bring the device up after non-fatal error

MEDIUM

5.5

CVSS Score

Published: October 21, 2024 at 07:39 PM UTC

Updated: October 15, 2026 at 01:19 AM UTC

15 products affected across 2 vendorsLinux KernelSIMATIC S7-1500 CPU 1518-4 Pn /dp MFP FirmwareSiplus S7-1500 CPU 1518-4 Pn /dp MFP Firmware

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: igb: Do not bring the device up after non-fatal error Commit 004d25060c78 ("igb: Fix igb_down hung on surprise removal") changed igb_io_error_detected() to ignore non-fatal pcie errors in order to avoid hung task that can happen when igb_down() is called multiple times. This caused an issue when processing transient non-fatal errors. igb_io_resume(), which is called after igb_io_error_detected(), assumes that device is brought down by igb_io_error_detected() if the interface is up. This resulted in panic with stacktrace below. [ T3256] igb 0000:09:00.0 haeth0: igb: haeth0 NIC Link is Down [ T292] pcieport 0000:00:1c.5: AER: Uncorrected (Non-Fatal) error received: 0000:09:00.0 [ T292] igb 0000:09:00.0: PCIe Bus Error: severity=Uncorrected (Non-Fatal), type=Transaction Layer, (Requester ID) [ T292] igb 0000:09:00.0: device [8086:1537] error status/mask=00004000/00000000 [ T292] igb 0000:09:00.0: [14] CmpltTO [ 200.105524,009][ T292] igb 0000:09:00.0: AER: TLP Header: 00000000 00000000 00000000 00000000 [ T292] pcieport 0000:00:1c.5: AER: broadcast error_detected message [ T292] igb 0000:09:00.0: Non-correctable non-fatal error reported. [ T292] pcieport 0000:00:1c.5: AER: broadcast mmio_enabled message [ T292] pcieport 0000:00:1c.5: AER: broadcast resume message [ T292] ------------[ cut here ]------------ [ T292] kernel BUG at net/core/dev.c:6539! [ T292] invalid opcode: 0000 [#1] PREEMPT SMP [ T292] RIP: 0010:napi_enable+0x37/0x40 [ T292] Call Trace: [ T292] <TASK> [ T292] ? die+0x33/0x90 [ T292] ? do_trap+0xdc/0x110 [ T292] ? napi_enable+0x37/0x40 [ T292] ? do_error_trap+0x70/0xb0 [ T292] ? napi_enable+0x37/0x40 [ T292] ? napi_enable+0x37/0x40 [ T292] ? exc_invalid_op+0x4e/0x70 [ T292] ? napi_enable+0x37/0x40 [ T292] ? asm_exc_invalid_op+0x16/0x20 [ T292] ? napi_enable+0x37/0x40 [ T292] igb_up+0x41/0x150 [ T292] igb_io_resume+0x25/0x70 [ T292] report_resume+0x54/0x70 [ T292] ? report_frozen_detected+0x20/0x20 [ T292] pci_walk_bus+0x6c/0x90 [ T292] ? aer_print_port_info+0xa0/0xa0 [ T292] pcie_do_recovery+0x22f/0x380 [ T292] aer_process_err_devices+0x110/0x160 [ T292] aer_isr+0x1c1/0x1e0 [ T292] ? disable_irq_nosync+0x10/0x10 [ T292] irq_thread_fn+0x1a/0x60 [ T292] irq_thread+0xe3/0x1a0 [ T292] ? irq_set_affinity_notifier+0x120/0x120 [ T292] ? irq_affinity_notify+0x100/0x100 [ T292] kthread+0xe2/0x110 [ T292] ? kthread_complete_and_exit+0x20/0x20 [ T292] ret_from_fork+0x2d/0x50 [ T292] ? kthread_complete_and_exit+0x20/0x20 [ T292] ret_from_fork_asm+0x11/0x20 [ T292] </TASK> To fix this issue igb_io_resume() checks if the interface is running and the device is not down this means igb_io_error_detected() did not bring the device down and there is no need to bring it up.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

4.14.322 ≤ v < 4.154.19.291 ≤ v < 4.205.10.188 ≤ v < 5.10.2275.15.150 ≤ v < 5.15.1685.4.251 ≤ v < 5.56.1.42 ≤ v < 6.1.1136.4.7 ≤ v < 6.56.5 ≤ v < 6.6.576.7 ≤ v < 6.11.4124e39a734cb90658b8f0dc110847bbfc6e3379239695e87d86f0e7d897fba1d2559f825aa20caeb4.14.322 4.19.29141f63b72a01c0e0ac59ab83fd2d921fcce0f602d4d25060c78fc31f66da0fa439c544dda1ac9d55.10.188 5.15.150 5.4.251 6.1.42 6.12 6.12 rc1 6.12 rc2 6.4.7994c2ceb70ea99264ccc6f09e6703ca267dad63cc2312e1d12b1c3ee4100c173131b102e2aed4d04c9f56f3c7bc908caa772112d3ae71cdd5d18c257fa92c463eba75dcedbd8d689ffdcb83293aaa0c3

Vendor states this is fixed in 0a94079e3841d00ea5abb05e3233d019a86745f6 (fixed)

Vendor states this is fixed in 330a699ecbfc9c26ec92c6310686da1230b4e7eb (fixed)

Vendor states this is fixed in 500be93c5d53b7e2c5314292012185f0207bad0c (fixed)

Vendor states this is fixed in 57c5053eaa5f9a8a99e34732e37a86615318e464 (fixed)

Vendor states this is fixed in 6a39c8f5c8aae74c5ab2ba466791f59ffaab0178 (fixed)

Vendor states this is fixed in c92cbd283ddcf55fd85a9a9b0ba13298213f3dd7 (fixed)

Vendor states this is fixed in d79af3af2f49c6aae9add3d492c04d60c1b85ce4 (fixed)

Vendor states this is fixed in dca2ca65a8695d9593e2cf1b40848e073ad75413 (fixed)

Affected range stops below 4.15, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 4.19.323 (unaffected)

Affected range stops below 4.20, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 5.10.227 (unaffected)

Vendor states this is fixed in 5.15.168 (unaffected)

Vendor states this is fixed in 5.4.285 (unaffected)

Affected range stops below 5.5, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 6.1.113 (unaffected)

Vendor states this is fixed in 6.11.4 (unaffected)

Vendor states this is fixed in 6.12 (unaffected)

Vendor states this is fixed in 6.5 (unaffected)

Vendor states this is fixed in 6.6.57 (unaffected)

RUGGEDCOM RST2428P Firmware · Siemens

60%

v < V3.2