CVE-2024-45030 igb: cope with large MAX_SKB_FRAGS
The Linux kernel igb driver causes payload corruption and potential crashes when MAX_SKB_FRAGS is set to large values due to improper ring layout calculation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45030?
CVE-2024-45030 is a critical memory corruption vulnerability in Linux kernel, published on 11 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
igb: cope with large MAX_SKB_FRAGS
Sabrina reports that the igb driver does not cope well with large MAX_SKB_FRAG values: setting MAX_SKB_FRAG to 45 causes payload corruption on TX.
An easy reproducer is to run ssh to connect to the machine. With MAX_SKB_FRAGS=17 it works, with MAX_SKB_FRAGS=45 it fails. This has been reported originally in https://bugzilla.redhat.com/show_bug.cgi?id=2265320
The root cause of the issue is that the driver does not take into account properly the (possibly large) shared info size when selecting the ring layout, and will try to fit two packets inside the same 4K page even when the 1st fraglist will trump over the 2nd head.
Address the issue by checking if 2K buffers are insufficient.
Weakness: CWE-787
Which versions are affected by CVE-2024-45030?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-45030?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-45030 being exploited?
There is no known exploitation of CVE-2024-45030 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-49236, BELL-CVE-2024-45030, DEBIAN-CVE-2024-45030, GHSA-pc7p-wr8c-6r5f, UBUNTU-CVE-2024-45030.