CVE-2024-42142 net/mlx5: E-switch, Create ingress ACL when needed
A missing ingress ACL in the Linux kernel mlx5 driver causes a panic when configuring active-backup LAG mode with disabled port metadata.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-42142?
CVE-2024-42142 is a medium-severity vulnerability in Linux kernel, published on 30 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: E-switch, Create ingress ACL when needed
Currently, ingress acl is used for three features. It is created only when vport metadata match and prio tag are enabled. But active-backup lag mode also uses it. It is independent of vport metadata match and prio tag. And vport metadata match can be disabled using the following devlink command:
# devlink dev param set pci/0000:08:00.0 name esw_port_metadata \ value false cmode runtime
If ingress acl is not created, will hit panic when creating drop rule for active-backup lag mode. If always create it, there will be about 5% performance degradation.
Fix it by creating ingress acl when needed. If esw_port_metadata is true, ingress acl exists, then create drop rule using existing ingress acl. If esw_port_metadata is false, create ingress acl and then create drop rule.
Which versions are affected by CVE-2024-42142?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-42142?
Apply the vendor's patch.
Is CVE-2024-42142 being exploited?
There is no known exploitation of CVE-2024-42142 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-42142, DEBIAN-CVE-2024-42142, GHSA-m87g-gjm6-7c8j, UBUNTU-CVE-2024-42142.