CVE-2024-43864 net/mlx5e: Fix CT entry update leaks of modify header context
A use-after-free vulnerability in the Linux kernel's mlx5e driver allows attackers to cause a system panic and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-43864?
CVE-2024-43864 is a critical use after free vulnerability in Linux kernel, published on 20 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix CT entry update leaks of modify header context
The cited commit allocates a new modify header to replace the old one when updating CT entry. But if failed to allocate a new one, eg. exceed the max number firmware can support, modify header will be an error pointer that will trigger a panic when deallocating it. And the old modify header point is copied to old attr. When the old attr is freed, the old modify header is lost.
Fix it by restoring the old attr to attr when failed to allocate a new modify header context. So when the CT entry is freed, the right modify header context will be freed. And the panic of accessing error pointer is also fixed.
Weakness: CWE-416
Which versions are affected by CVE-2024-43864?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-43864?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-43864 being exploited?
There is no known exploitation of CVE-2024-43864 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-43864, DEBIAN-CVE-2024-43864, GHSA-69w2-8rxh-w4m7, UBUNTU-CVE-2024-43864.