CVE-2024-26595 mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
A NULL pointer dereference in the mlxsw spectrum ACL TCAM driver allows local attackers to cause a kernel crash via specific network filter operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26595?
CVE-2024-26595 is a medium-severity vulnerability in Linux kernel, published on 23 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1].
Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam().
[1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Weakness: CWE-476
Which versions are affected by CVE-2024-26595?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-26595?
Apply the vendor's patch.
Is CVE-2024-26595 being exploited?
There is no known exploitation of CVE-2024-26595 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-39887, BELL-CVE-2024-26595, DEBIAN-CVE-2024-26595, GHSA-3jg5-5799-v5w6, ROOT-OS-DEBIAN-11-CVE-2024-26595, ROOT-OS-UBUNTU-2204-CVE-2024-26595 and 1 more.