{"id":"DEBIAN-CVE-2024-50042","details":"In the Linux kernel, the following vulnerability has been resolved:  ice: Fix increasing MSI-X on VF  Increasing MSI-X value on a VF leads to invalid memory operations. This is caused by not reallocating some arrays.  Reproducer:   modprobe ice   echo 0 \u003e /sys/bus/pci/devices/$PF_PCI/sriov_drivers_autoprobe   echo 1 \u003e /sys/bus/pci/devices/$PF_PCI/sriov_numvfs   echo 17 \u003e /sys/bus/pci/devices/$VF0_PCI/sriov_vf_msix_count  Default MSI-X is 16, so 17 and above triggers this issue.  KASAN reports:    BUG: KASAN: slab-out-of-bounds in ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice]   Read of size 8 at addr ffff8888b937d180 by task bash/28433   (...)    Call Trace:    (...)    ? ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice]    kasan_report+0xed/0x120    ? ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice]    ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice]    ice_vsi_cfg_def+0x3360/0x4770 [ice]    ? mutex_unlock+0x83/0xd0    ? __pfx_ice_vsi_cfg_def+0x10/0x10 [ice]    ? __pfx_ice_remove_vsi_lkup_fltr+0x10/0x10 [ice]    ice_vsi_cfg+0x7f/0x3b0 [ice]    ice_vf_reconfig_vsi+0x114/0x210 [ice]    ice_sriov_set_msix_vec_count+0x3d0/0x960 [ice]    sriov_vf_msix_count_store+0x21c/0x300    (...)    Allocated by task 28201:    (...)    ice_vsi_cfg_def+0x1c8e/0x4770 [ice]    ice_vsi_cfg+0x7f/0x3b0 [ice]    ice_vsi_setup+0x179/0xa30 [ice]    ice_sriov_configure+0xcaa/0x1520 [ice]    sriov_numvfs_store+0x212/0x390    (...)  To fix it, use ice_vsi_rebuild() instead of ice_vf_reconfig_vsi(). This causes the required arrays to be reallocated taking the new queue count into account (ice_vsi_realloc_stat_arrays()). Set req_txq and req_rxq before ice_vsi_rebuild(), so that realloc uses the newly set queue count.  Additionally, ice_vsi_rebuild() does not remove VSI filters (ice_fltr_remove_all()), so ice_vf_init_host_cfg() is no longer necessary.","modified":"2026-09-15T09:03:12.574478331Z","published":"2024-10-21T20:15:17.200Z","upstream":["CVE-2024-50042"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-50042"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-50042.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-50042.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}]}