CVE-2024-44970 (GCVE-0-2024-44970)
Vulnerability from cvelistv5
Published
2024-09-04 18:56
Modified
2026-08-05 11:37
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink When all the strides in a WQE have been consumed, the WQE is unlinked from the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible to receive CQEs with 0 consumed strides for the same WQE even after the WQE is fully consumed and unlinked. This triggers an additional unlink for the same wqe which corrupts the linked list. Fix this scenario by accepting 0 sized consumed strides without unlinking the WQE again.
References
Impacted products
Vendor Product Version
Linux Linux Version: f97d5c2a453e26071e3b0ec12161de57c4a237c4
Version: f97d5c2a453e26071e3b0ec12161de57c4a237c4
Version: f97d5c2a453e26071e3b0ec12161de57c4a237c4
Version: f97d5c2a453e26071e3b0ec12161de57c4a237c4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-44970",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:39:17.730265Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:34.757Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:14:21.145Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7b379353e9144e1f7460ff15f39862012c9d0d78",
              "status": "affected",
              "version": "f97d5c2a453e26071e3b0ec12161de57c4a237c4",
              "versionType": "git"
            },
            {
              "lessThan": "650e24748e1e0a7ff91d5c72b72a2f2a452b5b76",
              "status": "affected",
              "version": "f97d5c2a453e26071e3b0ec12161de57c4a237c4",
              "versionType": "git"
            },
            {
              "lessThan": "50d8009a0ac02c3311b23a0066511f8337bd88d9",
              "status": "affected",
              "version": "f97d5c2a453e26071e3b0ec12161de57c4a237c4",
              "versionType": "git"
            },
            {
              "lessThan": "fba8334721e266f92079632598e46e5f89082f30",
              "status": "affected",
              "version": "f97d5c2a453e26071e3b0ec12161de57c4a237c4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.105",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.46",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.5",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: SHAMPO, Fix invalid WQ linked list unlink\n\nWhen all the strides in a WQE have been consumed, the WQE is unlinked\nfrom the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible\nto receive CQEs with 0 consumed strides for the same WQE even after the\nWQE is fully consumed and unlinked. This triggers an additional unlink\nfor the same wqe which corrupts the linked list.\n\nFix this scenario by accepting 0 sized consumed strides without\nunlinking the WQE again."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the mlx5e RX completion handler, driven entirely by CQEs the NIC generates while receiving packets from the wire; a remote, routable attacker sending TCP traffic to the host reaches it with no local access. This is the network stack\u0027s receive path, not a syscall or ioctl interface.\nAC:L - The attacker controls the entire traffic pattern (flow count, segment sizes, session-flush triggers, packet rate) that drives SHAMPO coalescing to WQE boundaries, and can sustain it at line rate indefinitely, so the zero-consumed-strides CQE condition is hit repeatedly and reliably. There is no race against an uncontrolled party and no memory-layout precondition for the trigger.\nPR:N - No account, credentials, or authentication of any kind are required \u2014 the corruption happens in the NAPI RX completion path before any socket or protocol authorization layer is consulted. The attacker only needs to send packets that the NIC receives.\nUI:N - Packet processing happens automatically in the driver\u0027s NAPI poll; no administrator or user action is needed once the interface is up and receiving traffic.\nS:U - The corrupted WQ linked list, the underflowed cur_sz counter, and the prematurely released page-pool pages all belong to the host kernel\u0027s own RX ring. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The self-referencing free list and cur_sz underflow cause page-pool pages to be released while still referenced by outstanding hardware descriptors and in-flight skbs, so recycled kernel memory contents can be cross-attributed into packets delivered up the stack to userspace. Memory corruption of this class provides an arbitrary kernel-memory disclosure primitive.\nI:H - After the free-list self-loop stalls head advancement, mlx5e_post_rx_mpwqes() releases pages for which a UMR and RX WQE were already posted, so the NIC keeps DMA\u0027ing fully attacker-controlled packet bytes into freed and reallocated kernel pages \u2014 an arbitrary-content write into reused kernel memory, leverageable for control-flow hijacking. The driver additionally writes through a stale tail_next pointer.\nA:H - The corrupted linked list permanently stalls RQ replenishment and loses network connectivity, and the teardown path (mlx5e_free_rx_descs on link down, MTU change, or RQ recovery) spins re-deallocating the same WQE up to 65535 times, driving page refcount underflow and kernel oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:22.367Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7b379353e9144e1f7460ff15f39862012c9d0d78"
        },
        {
          "url": "https://git.kernel.org/stable/c/650e24748e1e0a7ff91d5c72b72a2f2a452b5b76"
        },
        {
          "url": "https://git.kernel.org/stable/c/50d8009a0ac02c3311b23a0066511f8337bd88d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/fba8334721e266f92079632598e46e5f89082f30"
        }
      ],
      "title": "net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-44970",
    "datePublished": "2024-09-04T18:56:46.807Z",
    "dateReserved": "2024-08-21T05:34:56.667Z",
    "dateUpdated": "2026-08-05T11:37:22.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:14:21.145Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-44970\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:39:17.730265Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:27.484Z\"}}], \"cna\": {\"title\": \"net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f97d5c2a453e26071e3b0ec12161de57c4a237c4\", \"lessThan\": \"7b379353e9144e1f7460ff15f39862012c9d0d78\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f97d5c2a453e26071e3b0ec12161de57c4a237c4\", \"lessThan\": \"650e24748e1e0a7ff91d5c72b72a2f2a452b5b76\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f97d5c2a453e26071e3b0ec12161de57c4a237c4\", \"lessThan\": \"50d8009a0ac02c3311b23a0066511f8337bd88d9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f97d5c2a453e26071e3b0ec12161de57c4a237c4\", \"lessThan\": \"fba8334721e266f92079632598e46e5f89082f30\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.105\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.46\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7b379353e9144e1f7460ff15f39862012c9d0d78\"}, {\"url\": \"https://git.kernel.org/stable/c/650e24748e1e0a7ff91d5c72b72a2f2a452b5b76\"}, {\"url\": \"https://git.kernel.org/stable/c/50d8009a0ac02c3311b23a0066511f8337bd88d9\"}, {\"url\": \"https://git.kernel.org/stable/c/fba8334721e266f92079632598e46e5f89082f30\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: SHAMPO, Fix invalid WQ linked list unlink\\n\\nWhen all the strides in a WQE have been consumed, the WQE is unlinked\\nfrom the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible\\nto receive CQEs with 0 consumed strides for the same WQE even after the\\nWQE is fully consumed and unlinked. This triggers an additional unlink\\nfor the same wqe which corrupts the linked list.\\n\\nFix this scenario by accepting 0 sized consumed strides without\\nunlinking the WQE again.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.105\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.46\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.5\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"5.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:32:57.567Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-44970\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:32:57.567Z\", \"dateReserved\": \"2024-08-21T05:34:56.667Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-04T18:56:46.807Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.