CVE-2024-53138 net/mlx5e: kTLS, Fix incorrect page refcounting
Incorrect page refcounting in Linux kernel kTLS handling can lead to use-after-free, potentially causing denial of service or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53138?
CVE-2024-53138 is a critical use after free vulnerability in Linux kernel, published on 4 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: kTLS, Fix incorrect page refcounting
The kTLS tx handling code is using a mix of get_page() and page_ref_inc() APIs to increment the page reference. But on the release path (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used.
This is an issue when using pages from large folios: the get_page() references are stored on the folio page while the page_ref_inc() references are stored directly in the given page. On release the folio page will be dereferenced too many times.
This was found while doing kTLS testing with sendfile() + ZC when the served file was read from NFS on a kernel with NFS large folios support (commit 49b29a573da8 ("nfs: add support for large folios")).
Which versions are affected by CVE-2024-53138?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-53138?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-53138 being exploited?
There is no known exploitation of CVE-2024-53138 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-54107, AZL-54135, BELL-CVE-2024-53138, DEBIAN-CVE-2024-53138, GHSA-r8vm-2j4g-7jq3, UBUNTU-CVE-2024-53138.