CVE-2023-54070
Use-After-Free in Linux igb Driver SR-IOV Cleanup Causes Hang
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| intel | igb | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's igb driver when enabling SR-IOV on certain Intel 82580 network devices. After a specific commit, if the igb module is loaded with the max_vfs parameter set to a non-zero value and then removed, the system could hang or crash. This happens because the cleanup process was not properly executed when pci_enable_sriov() failed, leading the driver to incorrectly assume virtual functions (VFs) were set up when they were not. This improper state causes errors and potential hangs during module removal.
How can this vulnerability impact me? :
The vulnerability can cause the system to hang or crash when the igb module is removed after being loaded with SR-IOV enabled on affected hardware (Intel 82580 dual or quad port). This can lead to system instability, potential downtime, and disruption of network services relying on the igb driver and SR-IOV functionality.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing system logs for specific error messages related to the igb module and PCIe bus errors when the module is removed or reloaded with the max_vfs parameter set to a non-zero value. Look for kernel log entries similar to PCIe Bus Error, AER errors, and hung tasks related to irq/aerdrv. You can use the command 'dmesg | grep igb' or 'journalctl -k | grep igb' to check for these errors. Additionally, running a script that repeatedly removes and reloads the igb module with max_vfs set (e.g., modprobe -rv igb; modprobe -v igb max_vfs=1) may reproduce the hang or crash if the system is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the removal of the igb module when it has been loaded with the max_vfs parameter set to a non-zero value, especially on affected hardware such as the 82580 dual or quad port. If possible, do not enable SR-IOV on these devices until the fix is applied. Alternatively, avoid using the max_vfs parameter or set it to 0 to prevent triggering the issue. Applying the patch or updating the kernel to a version that includes the fix for this issue is the definitive mitigation.