CVE-2024-35854 (GCVE-0-2024-35854)
Vulnerability from cvelistv5
Published
2024-05-17 14:47
Modified
2026-08-05 11:30
Summary
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash The rehash delayed work migrates filters from one region to another according to the number of available credits. The migrated from region is destroyed at the end of the work if the number of credits is non-negative as the assumption is that this is indicative of migration being complete. This assumption is incorrect as a non-negative number of credits can also be the result of a failed migration. The destruction of a region that still has filters referencing it can result in a use-after-free [1]. Fix by not destroying the region if migration failed. [1] BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 Read of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858 CPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G W 6.9.0-rc2-custom-00782-gf2275c2157d8 #5 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70 mlxsw_sp_acl_atcam_entry_del+0x81/0x210 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 174: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 Freed by task 7: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_region_destroy+0x272/0x310 mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
Impacted products
Vendor Product Version
Linux Linux Version: c9c9af91f1d9a636aecc55302c792538e549a430
Version: c9c9af91f1d9a636aecc55302c792538e549a430
Version: c9c9af91f1d9a636aecc55302c792538e549a430
Version: c9c9af91f1d9a636aecc55302c792538e549a430
Version: c9c9af91f1d9a636aecc55302c792538e549a430
Version: c9c9af91f1d9a636aecc55302c792538e549a430
Version: c9c9af91f1d9a636aecc55302c792538e549a430
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "c9c9af91f1d9"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "5.4.275"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "5.10.216"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "5.15.158"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "6.1.90"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "6.6.30"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "6.8.9"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "6.9"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35854",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-17T16:58:28.959142Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-16T21:17:40.149Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:47.699Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e118e7ea24d1392878ef85926627c6bc640c4388"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a429a912d6c779807f4d72a6cc0a1efaaa3613e1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4c89642ca47fb620914780c7c51d8d1248201121"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/813e2ab753a8f8c243a39ede20c2e0adc15f3887"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/311eeaa7b9e26aba5b3d57b09859f07d8e9fc049"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a02687044e124f8ccb427cd3632124a4e1a7d7c1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/54225988889931467a9b55fdbef534079b665519"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e118e7ea24d1392878ef85926627c6bc640c4388",
              "status": "affected",
              "version": "c9c9af91f1d9a636aecc55302c792538e549a430",
              "versionType": "git"
            },
            {
              "lessThan": "a429a912d6c779807f4d72a6cc0a1efaaa3613e1",
              "status": "affected",
              "version": "c9c9af91f1d9a636aecc55302c792538e549a430",
              "versionType": "git"
            },
            {
              "lessThan": "4c89642ca47fb620914780c7c51d8d1248201121",
              "status": "affected",
              "version": "c9c9af91f1d9a636aecc55302c792538e549a430",
              "versionType": "git"
            },
            {
              "lessThan": "813e2ab753a8f8c243a39ede20c2e0adc15f3887",
              "status": "affected",
              "version": "c9c9af91f1d9a636aecc55302c792538e549a430",
              "versionType": "git"
            },
            {
              "lessThan": "311eeaa7b9e26aba5b3d57b09859f07d8e9fc049",
              "status": "affected",
              "version": "c9c9af91f1d9a636aecc55302c792538e549a430",
              "versionType": "git"
            },
            {
              "lessThan": "a02687044e124f8ccb427cd3632124a4e1a7d7c1",
              "status": "affected",
              "version": "c9c9af91f1d9a636aecc55302c792538e549a430",
              "versionType": "git"
            },
            {
              "lessThan": "54225988889931467a9b55fdbef534079b665519",
              "status": "affected",
              "version": "c9c9af91f1d9a636aecc55302c792538e549a430",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.275",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.275",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.216",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.158",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.90",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.30",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.9",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash\n\nThe rehash delayed work migrates filters from one region to another\naccording to the number of available credits.\n\nThe migrated from region is destroyed at the end of the work if the\nnumber of credits is non-negative as the assumption is that this is\nindicative of migration being complete. This assumption is incorrect as\na non-negative number of credits can also be the result of a failed\nmigration.\n\nThe destruction of a region that still has filters referencing it can\nresult in a use-after-free [1].\n\nFix by not destroying the region if migration failed.\n\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\nRead of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858\n\nCPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G        W          6.9.0-rc2-custom-00782-gf2275c2157d8 #5\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xc6/0x120\n print_report+0xce/0x670\n kasan_report+0xd7/0x110\n mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\n mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70\n mlxsw_sp_acl_atcam_entry_del+0x81/0x210\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 174:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc+0x19c/0x360\n mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n\nFreed by task 7:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n poison_slab_object+0x102/0x170\n __kasan_slab_free+0x14/0x30\n kfree+0xc1/0x290\n mlxsw_sp_acl_tcam_region_destroy+0x272/0x310\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only path into the vulnerable rehash work is local configuration of hardware-offloaded tc flower filters via rtnetlink (`mlxsw_sp_flower_replace` \u2192 `mlxsw_sp_acl_rule_add`), plus the devlink `acl_region_rehash_interval` knob; the multicast-routing ruleset that could be influenced by received traffic explicitly disables rehash, so no received packet reaches this code.\nAC:L - The attacker controls every precondition \u2014 the number, priority and mask diversity of offloaded filters, and hence the eRP/TCAM resource exhaustion that makes migration and its rollback fail \u2014 while the rehash delayed work re-arms itself automatically every 5 s, so there is no race to win and no state outside the attacker\u0027s influence.\nPR:L - Installing offloaded flower filters requires only CAP_NET_ADMIN checked against the owning network namespace\u0027s user_ns (`netlink_net_capable(skb, CAP_NET_ADMIN)`), which an unprivileged user holds in their own user namespace once a switch port is delegated to that netns \u2014 not real root in the initial namespace.\nUI:N - The attacker performs all steps itself \u2014 adding and removing tc flower rules until the device runs out of resources \u2014 and the periodic rehash worker then fires on its own with no victim action.\nS:U - The freed object and all subsequent dereferences are kernel heap memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed `mlxsw_sp_acl_tcam_region` comes from a sprayable general-purpose kmalloc cache and is later dereferenced as `cregion-\u003eregion-\u003etcam_region_info` and `cregion-\u003eparman`, so reclaiming the slot lets the attacker steer reads to arbitrary kernel addresses; per use-after-free scoring this is High.\nI:H - The same stale allocation is used for an indirect call `cregion-\u003eops-\u003eentry_remove(...)` and for `parman_item_remove()`/`rhashtable_remove_fast()`/`list_del()` writes, giving both a control-flow-hijack and a controlled-write primitive; stale `tcam_region_info` is additionally written to the ASIC, corrupting the switch\u0027s hardware ACL state.\nA:H - The confirmed KASAN slab-use-after-free in `mlxsw_sp_acl_ctcam_region_entry_remove()` runs from the `mlxsw_core` workqueue and reliably oopses/panics the kernel, and because the work re-arms every 5 s the condition recurs until the switch is unusable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:18.702Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e118e7ea24d1392878ef85926627c6bc640c4388"
        },
        {
          "url": "https://git.kernel.org/stable/c/a429a912d6c779807f4d72a6cc0a1efaaa3613e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c89642ca47fb620914780c7c51d8d1248201121"
        },
        {
          "url": "https://git.kernel.org/stable/c/813e2ab753a8f8c243a39ede20c2e0adc15f3887"
        },
        {
          "url": "https://git.kernel.org/stable/c/311eeaa7b9e26aba5b3d57b09859f07d8e9fc049"
        },
        {
          "url": "https://git.kernel.org/stable/c/a02687044e124f8ccb427cd3632124a4e1a7d7c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/54225988889931467a9b55fdbef534079b665519"
        }
      ],
      "title": "mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35854",
    "datePublished": "2024-05-17T14:47:30.775Z",
    "dateReserved": "2024-05-17T13:50:33.106Z",
    "dateUpdated": "2026-08-05T11:30:18.702Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e118e7ea24d1392878ef85926627c6bc640c4388\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a429a912d6c779807f4d72a6cc0a1efaaa3613e1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4c89642ca47fb620914780c7c51d8d1248201121\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/813e2ab753a8f8c243a39ede20c2e0adc15f3887\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/311eeaa7b9e26aba5b3d57b09859f07d8e9fc049\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a02687044e124f8ccb427cd3632124a4e1a7d7c1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/54225988889931467a9b55fdbef534079b665519\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:47.699Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35854\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-17T16:58:28.959142Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"c9c9af91f1d9\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.1\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.4.275\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.10.216\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.15.158\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.1.90\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.6.30\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.8.9\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.9\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-17T17:06:14.156Z\"}}], \"cna\": {\"title\": \"mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The only path into the vulnerable rehash work is local configuration of hardware-offloaded tc flower filters via rtnetlink (`mlxsw_sp_flower_replace` \\u2192 `mlxsw_sp_acl_rule_add`), plus the devlink `acl_region_rehash_interval` knob; the multicast-routing ruleset that could be influenced by received traffic explicitly disables rehash, so no received packet reaches this code.\\nAC:L - The attacker controls every precondition \\u2014 the number, priority and mask diversity of offloaded filters, and hence the eRP/TCAM resource exhaustion that makes migration and its rollback fail \\u2014 while the rehash delayed work re-arms itself automatically every 5 s, so there is no race to win and no state outside the attacker\u0027s influence.\\nPR:L - Installing offloaded flower filters requires only CAP_NET_ADMIN checked against the owning network namespace\u0027s user_ns (`netlink_net_capable(skb, CAP_NET_ADMIN)`), which an unprivileged user holds in their own user namespace once a switch port is delegated to that netns \\u2014 not real root in the initial namespace.\\nUI:N - The attacker performs all steps itself \\u2014 adding and removing tc flower rules until the device runs out of resources \\u2014 and the periodic rehash worker then fires on its own with no victim action.\\nS:U - The freed object and all subsequent dereferences are kernel heap memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The freed `mlxsw_sp_acl_tcam_region` comes from a sprayable general-purpose kmalloc cache and is later dereferenced as `cregion-\u003eregion-\u003etcam_region_info` and `cregion-\u003eparman`, so reclaiming the slot lets the attacker steer reads to arbitrary kernel addresses; per use-after-free scoring this is High.\\nI:H - The same stale allocation is used for an indirect call `cregion-\u003eops-\u003eentry_remove(...)` and for `parman_item_remove()`/`rhashtable_remove_fast()`/`list_del()` writes, giving both a control-flow-hijack and a controlled-write primitive; stale `tcam_region_info` is additionally written to the ASIC, corrupting the switch\u0027s hardware ACL state.\\nA:H - The confirmed KASAN slab-use-after-free in `mlxsw_sp_acl_ctcam_region_entry_remove()` runs from the `mlxsw_core` workqueue and reliably oopses/panics the kernel, and because the work re-arms every 5 s the condition recurs until the switch is unusable.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c9c9af91f1d9a636aecc55302c792538e549a430\", \"lessThan\": \"e118e7ea24d1392878ef85926627c6bc640c4388\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c9c9af91f1d9a636aecc55302c792538e549a430\", \"lessThan\": \"a429a912d6c779807f4d72a6cc0a1efaaa3613e1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c9c9af91f1d9a636aecc55302c792538e549a430\", \"lessThan\": \"4c89642ca47fb620914780c7c51d8d1248201121\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c9c9af91f1d9a636aecc55302c792538e549a430\", \"lessThan\": \"813e2ab753a8f8c243a39ede20c2e0adc15f3887\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c9c9af91f1d9a636aecc55302c792538e549a430\", \"lessThan\": \"311eeaa7b9e26aba5b3d57b09859f07d8e9fc049\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c9c9af91f1d9a636aecc55302c792538e549a430\", \"lessThan\": \"a02687044e124f8ccb427cd3632124a4e1a7d7c1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c9c9af91f1d9a636aecc55302c792538e549a430\", \"lessThan\": \"54225988889931467a9b55fdbef534079b665519\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.1\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.1\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.275\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.216\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.158\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.90\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.30\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e118e7ea24d1392878ef85926627c6bc640c4388\"}, {\"url\": \"https://git.kernel.org/stable/c/a429a912d6c779807f4d72a6cc0a1efaaa3613e1\"}, {\"url\": \"https://git.kernel.org/stable/c/4c89642ca47fb620914780c7c51d8d1248201121\"}, {\"url\": \"https://git.kernel.org/stable/c/813e2ab753a8f8c243a39ede20c2e0adc15f3887\"}, {\"url\": \"https://git.kernel.org/stable/c/311eeaa7b9e26aba5b3d57b09859f07d8e9fc049\"}, {\"url\": \"https://git.kernel.org/stable/c/a02687044e124f8ccb427cd3632124a4e1a7d7c1\"}, {\"url\": \"https://git.kernel.org/stable/c/54225988889931467a9b55fdbef534079b665519\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash\\n\\nThe rehash delayed work migrates filters from one region to another\\naccording to the number of available credits.\\n\\nThe migrated from region is destroyed at the end of the work if the\\nnumber of credits is non-negative as the assumption is that this is\\nindicative of migration being complete. This assumption is incorrect as\\na non-negative number of credits can also be the result of a failed\\nmigration.\\n\\nThe destruction of a region that still has filters referencing it can\\nresult in a use-after-free [1].\\n\\nFix by not destroying the region if migration failed.\\n\\n[1]\\nBUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\\nRead of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858\\n\\nCPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G        W          6.9.0-rc2-custom-00782-gf2275c2157d8 #5\\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0xc6/0x120\\n print_report+0xce/0x670\\n kasan_report+0xd7/0x110\\n mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\\n mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70\\n mlxsw_sp_acl_atcam_entry_del+0x81/0x210\\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50\\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\\n process_one_work+0x8eb/0x19b0\\n worker_thread+0x6c9/0xf70\\n kthread+0x2c9/0x3b0\\n ret_from_fork+0x4d/0x80\\n ret_from_fork_asm+0x1a/0x30\\n \u003c/TASK\u003e\\n\\nAllocated by task 174:\\n kasan_save_stack+0x33/0x60\\n kasan_save_track+0x14/0x30\\n __kasan_kmalloc+0x8f/0xa0\\n __kmalloc+0x19c/0x360\\n mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0\\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300\\n process_one_work+0x8eb/0x19b0\\n worker_thread+0x6c9/0xf70\\n kthread+0x2c9/0x3b0\\n ret_from_fork+0x4d/0x80\\n ret_from_fork_asm+0x1a/0x30\\n\\nFreed by task 7:\\n kasan_save_stack+0x33/0x60\\n kasan_save_track+0x14/0x30\\n kasan_save_free_info+0x3b/0x60\\n poison_slab_object+0x102/0x170\\n __kasan_slab_free+0x14/0x30\\n kfree+0xc1/0x290\\n mlxsw_sp_acl_tcam_region_destroy+0x272/0x310\\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300\\n process_one_work+0x8eb/0x19b0\\n worker_thread+0x6c9/0xf70\\n kthread+0x2c9/0x3b0\\n ret_from_fork+0x4d/0x80\\n ret_from_fork_asm+0x1a/0x30\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.275\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.216\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.158\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.90\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.30\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.9\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"5.1\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:30:18.702Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35854\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:30:18.702Z\", \"dateReserved\": \"2024-05-17T13:50:33.106Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T14:47:30.775Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…