CVE-2024-56649 is a vulnerability identified in the Linux kernel's ENETC (Ethernet Controller) driver, specifically affecting the configuration of preemptible Traffic Classes (TCs) in the network queuing discipline (mqprio) setup. The issue arises because both Physical Function (PF) and Virtual Function (VF) drivers share the function enetc_setup_tc_mqprio() to configure MQPRIO, which internally calls enetc_change_preemptible_tcs() to configure preemptible TCs. However, only PF drivers have the necessary hardware registers to support preemptible TCs, while VF drivers lack these registers, resulting in a NULL hw->port pointer. When VF drivers attempt to access these non-existent registers, a NULL pointer dereference occurs, causing a kernel crash (panic). This is evidenced by kernel logs showing an invalid memory access during the execution of enetc_mm_commit_preemptible_tcs(). Additionally, some PFs, such as eno1 and eno3 on the LS1028A platform, do not support configuring preemptible TCs either. While these PFs do not cause crashes, the vulnerability highlights the need to prevent access to unimplemented registers to avoid instability. This vulnerability can be triggered by a network administrator or attacker with the ability to configure traffic control (tc) settings on affected network interfaces, specifically by issuing commands to add mqprio qdiscs with preemptible TCs on VF devices. The root cause is a lack of proper validation and differentiation between PF and VF capabilities in the driver code, leading to unsafe memory access in the kernel space. No known exploits are reported in the wild, and no CVSS score has been assigned yet. The vulnerability affects Linux kernel versions containing the affected commit (hash 827145392a4aad635b93e5235b7d7fecc2fa31c7) and likely impacts systems using ENETC network controllers with VF support, commonly found in embedded or specialized networking hardware platforms such as LS1028A.

For European organizations, the impact of CVE-2024-56649 depends on their deployment of Linux systems utilizing ENETC network controllers with VF capabilities. The vulnerability can cause kernel crashes, leading to denial of service (DoS) conditions on affected hosts. This can disrupt critical network functions, especially in environments relying on virtualized network functions or containerized workloads where VF devices are used for performance and isolation. Industries such as telecommunications, cloud service providers, and enterprises with advanced networking infrastructure may be particularly affected if they use hardware platforms like LS1028A or similar that incorporate ENETC controllers. A kernel crash can result in service outages, data loss, and operational downtime, impacting business continuity and potentially violating regulatory requirements for availability and resilience. Since exploitation requires local administrative privileges to configure traffic control settings, the threat is mitigated somewhat by access controls. However, insider threats or compromised administrative accounts could leverage this vulnerability to cause disruption. Additionally, automated orchestration or configuration management tools that apply network settings could inadvertently trigger the crash if not updated. Overall, the vulnerability poses a medium risk to European organizations with relevant hardware and Linux kernel versions, primarily through DoS attacks affecting network stability and availability.

1. Apply the official Linux kernel patches that address this vulnerability by adding proper checks to prevent VF drivers from accessing unimplemented registers and disabling preemptible TC configuration on unsupported PFs. 2. Audit and restrict administrative access to systems with ENETC network controllers to minimize the risk of unauthorized or accidental triggering of the vulnerability via traffic control commands. 3. Implement monitoring of kernel logs and network configuration changes to detect attempts to add mqprio qdiscs with preemptible TCs on VF devices. 4. For environments using orchestration or automation tools, update scripts and configurations to avoid applying mqprio settings that enable preemptible TCs on VF interfaces. 5. If patching is not immediately possible, consider disabling or avoiding the use of VF devices on affected hardware or refrain from configuring preemptible TCs until a fix is applied. 6. Engage with hardware vendors to confirm the presence of ENETC controllers and obtain guidance or firmware updates that may complement kernel patches. 7. Conduct thorough testing in staging environments before deploying network configuration changes to production systems to prevent inadvertent crashes.