{"dataType":"CVE_RECORD","cveMetadata":{"cveId":"CVE-2024-36020","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-05-17T13:50:33.157Z","datePublished":"2024-05-30T14:59:44.447Z","dateUpdated":"2026-08-05T11:31:40.320Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:31:40.320Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix vf may be used uninitialized in this function warning\n\nTo fix the regression introduced by commit 52424f974bc5, which causes\nservers hang in very hard to reproduce conditions with resets races.\nUsing two sources for the information is the root cause.\nIn this function before the fix bumping v didn't mean bumping vf\npointer. But the code used this variables interchangeably, so stale vf\ncould point to different/not intended vf.\n\nRemove redundant \"v\" variable and iterate via single VF pointer across\nwhole function instead to guarantee VF pointer validity."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is the i40e SR-IOV PF reset orchestration, reached through local operations — sysfs `sriov_numvfs`, ethtool/PF reconfiguration, RTNL `ndo_set_vf_*`, and VF-side virtchnl/VFLR events delivered over PCIe. No remotely received network packet is parsed on this path, so the attacker needs local access to the host or to an attached VF/guest.\nAC:L - This is a race, but the attacker drives it: VF resets can be triggered in a tight loop (VFLR, virtchnl RESET_VF, MTU/ethtool on a delegated VF netdev, MDD/overflow storms) while VF add/remove or PF reconfiguration repeatedly re-enters `i40e_reset_all_vfs()`. The vulnerable window is wide — the in-flight `i40e_reset_vf()` holds `RESETTING` across 150–250 ms of sleeps — so repeated attempts land reliably.\nPR:L - The VF-reset side of the race requires no host privileges at all — a guest VM owning an assigned VF, or an unprivileged container holding a delegated iavf netdev with CAP_NET_ADMIN in its own user namespace, can trigger it at will. In SR-IOV cloud hosts the `sriov_numvfs`/PF-reset side is itself driven by tenant-initiated VM/pod lifecycle events, so no real root in the init namespace is needed.\nUI:N - Exploitation needs only the attacker's own reset traffic and concurrent VF/PF reconfiguration; no administrator or other user has to open a file, mount anything, or take any action.\nS:U - The corruption and the crash are confined to the host kernel, which is the same security authority as the vulnerable driver; no IOMMU or hypervisor isolation boundary is bypassed by the bug itself.\nC:H - The defeated `RESETTING` guard allows two threads to release the same VF VSI, and `i40e_vsi_clear()` unconditionally `kfree()`s it even on the mismatch path, yielding a double-free/use-after-free of `i40e_vsi`, its ring arrays and netdev. A freed-and-reallocated VSI that is still dereferenced gives an attacker who sprays the slab a kernel-memory read primitive.\nI:H - The same double-free/UAF lets attacker-controlled heap data occupy the freed `i40e_vsi`, whose fields (ring pointers, q_vector arrays, `pf->vsi[]` slot) are subsequently written and dereferenced, providing a write primitive suitable for control-flow hijack. The mis-gated cleanup also lets HW register programming and resource accounting be applied to the wrong VF.\nA:H - The upstream author states the bug hangs servers: when the stale pointer reports RESETTING, `i40e_cleanup_reset_vf()` is skipped for every VF, leaving all VFs wedged in reset with `VPGEN_VFRTRIG` asserted and no `VFACTIVE` handshake, killing networking for every guest on the adapter. The double-free path additionally produces an immediate kernel oops/panic."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"],"versions":[{"version":"76ed715836c6994bac29d9638e9314e6e3b08651","lessThan":"cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d","status":"affected","versionType":"git"},{"version":"e88c2a1e28c5475065563d66c07ca879a9afbd07","lessThan":"9dcf0fcb80f6aeb01469e3c957f8d4c97365450a","status":"affected","versionType":"git"},{"version":"9abae363af5ced6adbf04c14366289540281fb26","lessThan":"b8e82128b44fa40bf99a50b919488ef361e1683c","status":"affected","versionType":"git"},{"version":"c39de3ae5075ea5f78e097cb5720d4e52d5caed9","lessThan":"951d2748a2a8242853abc3d0c153ce4bf8faad31","status":"affected","versionType":"git"},{"version":"52424f974bc53c26ba3f00300a00e9de9afcd972","lessThan":"3e89846283f3cf7c7a8e28b342576fd7c561d2ba","status":"affected","versionType":"git"},{"version":"52424f974bc53c26ba3f00300a00e9de9afcd972","lessThan":"0dcf573f997732702917af1563aa2493dc772fc0","status":"affected","versionType":"git"},{"version":"52424f974bc53c26ba3f00300a00e9de9afcd972","lessThan":"06df7618f591b2dc43c59967e294d7b9fc8675b6","status":"affected","versionType":"git"},{"version":"52424f974bc53c26ba3f00300a00e9de9afcd972","lessThan":"f37c4eac99c258111d414d31b740437e1925b8e8","status":"affected","versionType":"git"},{"version":"02f949747e6fb767b29f7931d4bbf40911684e7a","status":"affected","versionType":"git"},{"version":"4.19.264","lessThan":"4.19.312","status":"affected","versionType":"semver"},{"version":"5.4.223","lessThan":"5.4.274","status":"affected","versionType":"semver"},{"version":"5.10.153","lessThan":"5.10.215","status":"affected","versionType":"semver"},{"version":"5.15.77","lessThan":"5.15.154","status":"affected","versionType":"semver"},{"version":"6.0.7","lessThan":"6.1","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"],"versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","status":"unaffected","versionType":"semver"},{"version":"4.19.312","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.274","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.215","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.154","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.85","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.26","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.8.5","lessThanOrEqual":"6.8.*","status":"unaffected","versionType":"semver"},{"version":"6.9","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.264","versionEndExcluding":"4.19.312"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.223","versionEndExcluding":"5.4.274"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.153","versionEndExcluding":"5.10.215"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.77","versionEndExcluding":"5.15.154"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.1.85"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.6.26"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.8.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.7"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d"},{"url":"https://git.kernel.org/stable/c/9dcf0fcb80f6aeb01469e3c957f8d4c97365450a"},{"url":"https://git.kernel.org/stable/c/b8e82128b44fa40bf99a50b919488ef361e1683c"},{"url":"https://git.kernel.org/stable/c/951d2748a2a8242853abc3d0c153ce4bf8faad31"},{"url":"https://git.kernel.org/stable/c/3e89846283f3cf7c7a8e28b342576fd7c561d2ba"},{"url":"https://git.kernel.org/stable/c/0dcf573f997732702917af1563aa2493dc772fc0"},{"url":"https://git.kernel.org/stable/c/06df7618f591b2dc43c59967e294d7b9fc8675b6"},{"url":"https://git.kernel.org/stable/c/f37c4eac99c258111d414d31b740437e1925b8e8"}],"title":"i40e: fix vf may be used uninitialized in this function warning","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-36020","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-06-03T16:54:29.774868Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-04T17:48:10.052Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T03:30:12.504Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/9dcf0fcb80f6aeb01469e3c957f8d4c97365450a","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b8e82128b44fa40bf99a50b919488ef361e1683c","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/951d2748a2a8242853abc3d0c153ce4bf8faad31","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/3e89846283f3cf7c7a8e28b342576fd7c561d2ba","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/0dcf573f997732702917af1563aa2493dc772fc0","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/06df7618f591b2dc43c59967e294d7b9fc8675b6","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/f37c4eac99c258111d414d31b740437e1925b8e8","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","tags":["x_transferred"]}]},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-05-12T11:53:39.635Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","versions":[{"status":"affected","version":"0","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]},"dataVersion":"5.2"}